Skip to content

MCP Server

BCP Portal ships its own MCP (Model Context Protocol) server — meaning any MCP-compatible client (Claude Desktop, Cursor, Claude Code, etc.) can talk to the platform in natural language, using your organization's data.

This is the same AI Assistant that lives in the portal and in Slack — just available from your daily tools.

Why this is powerful

  • Ask "what's my current security posture" right from your IDE.
  • Have Cursor auto-fetch your last GitHub findings when it drafts a fix.
  • Let Claude Desktop summarize your alerts as part of a broader morning briefing.
  • All of this without giving Claude Desktop access to anything except what you already see in BCP Portal.

Compatible clients

  • Claude Desktop — Anthropic's desktop app.
  • Cursor — the code editor.
  • Claude Code — CLI agent.
  • Any other client that supports the MCP spec.

Generating a token

The MCP server requires a personal access token. Generate it at https://bcp.bytecode.team/settings/mcp-tokens/.

  1. Log into BCP Portal.
  2. Go to Settings → MCP Tokens → New Token.
  3. Give it a name (e.g., "Claude Desktop on laptop").
  4. Click Generate.
  5. Copy the token immediately — it's shown only once. Once you close the modal there's no way to see the full token again.

If you lost a token — revoke the old one and generate a new one.

Connecting Claude Desktop

  1. Open Claude Desktop → Settings → Developer → Edit Config.

  2. Add the following block to claude_desktop_config.json:

    json { "mcpServers": { "bcp-portal": { "url": "https://bcp.bytecode.team/mcp", "auth": { "type": "bearer", "token": "YOUR_TOKEN_HERE" } } } }

  3. Save and restart Claude Desktop.

  4. When Claude Desktop starts, a tool icon appears in the chat — hover over it and you'll see the BCP Portal tools list. That's your sign the connection works.

Connecting Cursor

  1. Cursor → Settings → MCP → Add Server.
  2. Name: bcp-portal, URL: https://bcp.bytecode.team/mcp, auth: Bearer, token: paste yours.
  3. Save. Cursor picks it up automatically — the tools are available in Composer / chat.

Connecting Claude Code (CLI)

bash claude mcp add bcp-portal https://bcp.bytecode.team/mcp \ --auth-type bearer --token YOUR_TOKEN_HERE

After that any Claude Code session in your terminal has access.

Verifying the connection

Ask your MCP client something specific for BCP Portal, e.g.:

  • "Use the bcp-portal tool to show my active critical alerts."
  • "Ask BCP Portal for my current security posture score."

If it answers — everything works. If it doesn't see the tool — restart the client, check that the token is copied correctly (no leading/trailing spaces), and that https://bcp.bytecode.team/mcp is reachable.

What the MCP client can do

The MCP tools mirror the same capabilities as the AI Assistant:

  • Get alerts by severity, source, status, date range.
  • Get security posture score and breakdown.
  • Get scan history and results.
  • Trigger scans (HIBP, Pastebin, code) — on demand.
  • Get user and organization info (for admins).

Security

  • Tokens are tied to your BCP Portal user. The MCP client sees only what you can see — the same as in the portal UI.
  • Tokens can be revoked at any moment at https://bcp.bytecode.team/settings/mcp-tokens/.
  • If you suspect a token leaked (a laptop was lost, disk exposed) — revoke it immediately.
  • The token is stored only on the client and passed to us as a Bearer header. We never see it in plaintext after generation.

Rotation

We recommend rotating tokens every 3-6 months. Rotation flow:

  1. Generate a new token.
  2. Update the config in the MCP client (Claude Desktop, Cursor, etc.).
  3. Revoke the old token.

Rotation doesn't interrupt anything if you do it in this order.