Connecting an agent

IndexZero runs a Model Context Protocol server at:

https://app.indexzero.site/mcp

It speaks Streamable HTTP and exposes 36 tools: the same ones the dashboard uses, spending the same credits, scoped to the same projects. Legacy SSE transport is not supported.

Pick your client

Two ways to authenticate

OAuth is for interactive clients. You give the client the endpoint URL and nothing else; it discovers the authorization server, registers itself, and opens a browser window for you to approve. Tokens are scoped, expire, and can be refreshed. Details in OAuth.

API keys are for everything without a browser: scripts, CI, a server-side agent, a client that does not implement OAuth. Create one on the AI & MCP page in the app and send it as an x-api-key header. Keys are confined to the MCP endpoint and can never reach account or billing endpoints. Details in API keys.

Both arrive at the same server with the same tools. The only difference is how the request proves which workspace it belongs to.

What the agent is told

The server hands every connected client a set of instructions along with the tool list. In short:

• Most tools read live search data and spend the workspace's credits; call whoami first to see the plan and the remaining balance.
• Do normal focused research without asking, but confirm with the user before any single action expected to cost more than about 2,000 credits. run_rank_tracker on a large tracker and run_site_audit on a big site are the two that get expensive.
• estimate_rank_tracker_cost is free; always call it before run_rank_tracker and report the number.
• run_site_audit is asynchronous; poll get_audit_status until it reports completed before reading issues.
• Search Console, Analytics, and PostHog tools are free and read the user's own measured data; prefer them over paid estimates when the question is about the user's own site.

Every tool's description also says whether it costs credits, so a well-behaved agent can budget without reading this page.

What a tool call returns

Each result carries the full rows as a text table (not a summary), the same data as structured content, and a small _meta block with the organization and project ids, a deep link into the dashboard where relevant, and, for paid calls, the credits charged and remaining. Errors come back as tool results marked isError with an actionable hint, never as a dropped connection. See Errors.

Verifying the connection

Ask the agent to list your IndexZero projects. If it answers with the projects you see in the dashboard, the connection, the plan gate, and the workspace binding are all correct. whoami is the equivalent single call.