# Connecting an agent

> One MCP endpoint, two ways to authenticate. Which to use, what the agent gets, and what it is told about cost.

Source: https://docs.indexzero.site/agents



IndexZero runs a [Model Context Protocol](https://modelcontextprotocol.io) server at:

```
https://app.indexzero.site/mcp
```

It speaks **Streamable HTTP** and exposes <ToolCount /> tools: the same ones the dashboard uses, spending the same credits, scoped to the same projects. Legacy SSE transport is not supported.

<Callout title="MCP access is a paid feature">
  Connecting an agent requires the Starter plan or above. On the Free plan the endpoint authenticates but every tool call is refused with a plan-upgrade error. See [Plans](/plans).
</Callout>

## Pick your client [#pick-your-client]

<Cards>
  <Card title="Claude Code" href="/agents/claude-code" description="One terminal command, OAuth in the browser." />

  <Card title="Claude desktop and web" href="/agents/claude" description="Add a custom connector in Settings." />

  <Card title="Cursor" href="/agents/cursor" description="A four-line mcp.json." />

  <Card title="ChatGPT" href="/agents/chatgpt" description="Add IndexZero as a connector." />

  <Card title="Codex" href="/agents/codex" description="Register the server with the Codex CLI." />

  <Card title="Any other client" href="/agents/other-clients" description="The generic configuration, for Hermes, OpenClaw, and anything that speaks MCP." />
</Cards>

## Two ways to authenticate [#two-ways-to-authenticate]

**OAuth** is for interactive clients. You give the client the endpoint URL and nothing else; it discovers the authorization server, registers itself, and opens a browser window for you to approve. Tokens are scoped, expire, and can be refreshed. Details in [OAuth](/agents/oauth).

**API keys** are for everything without a browser: scripts, CI, a server-side agent, a client that does not implement OAuth. Create one on the **AI & MCP** page in the app and send it as an `x-api-key` header. Keys are confined to the MCP endpoint and can never reach account or billing endpoints. Details in [API keys](/agents/api-keys).

Both arrive at the same server with the same tools. The only difference is how the request proves which workspace it belongs to.

## What the agent is told [#what-the-agent-is-told]

The server hands every connected client a set of instructions along with the tool list. In short:

* Most tools read live search data and spend the workspace's credits; call `whoami` first to see the plan and the remaining balance.
* Do normal focused research without asking, but confirm with the user before any single action expected to cost more than about 2,000 credits. `run_rank_tracker` on a large tracker and `run_site_audit` on a big site are the two that get expensive.
* `estimate_rank_tracker_cost` is free; always call it before `run_rank_tracker` and report the number.
* `run_site_audit` is asynchronous; poll `get_audit_status` until it reports `completed` before reading issues.
* Search Console, Analytics, and PostHog tools are free and read the user's own measured data; prefer them over paid estimates when the question is about the user's own site.

Every tool's description also says whether it costs credits, so a well-behaved agent can budget without reading this page.

## What a tool call returns [#what-a-tool-call-returns]

Each result carries the full rows as a text table (not a summary), the same data as structured content, and a small `_meta` block with the organization and project ids, a deep link into the dashboard where relevant, and, for paid calls, the credits charged and remaining. Errors come back as tool results marked `isError` with an actionable hint, never as a dropped connection. See [Errors](/reference/errors).

## Verifying the connection [#verifying-the-connection]

Ask the agent to list your IndexZero projects. If it answers with the projects you see in the dashboard, the connection, the plan gate, and the workspace binding are all correct. `whoami` is the equivalent single call.