MCP Server

Ossprey exposes a Model Context Protocol (MCP) server at POST https://api.ossprey.com/public/v1/mcp, so AI agents and MCP-capable clients can scan packages and read results as first-class tools.

Transport and auth

Transport — stateless Streamable HTTP: each request is a JSON-RPC 2.0 message (or batch) POSTed to the endpoint.
Auth — the same x-api-key header as the rest of the public API.
Methods — initialize, ping, tools/list, tools/call, and notifications/* acknowledgements. Requests (with an id) get a 200 JSON-RPC response; notifications (no id) are acknowledged with 202 and no body.

Available tools

The MCP tools wrap the public scan API:

Tool	Wraps
`list_scans`	`GET /public/v1/scans`
`get_scan`	`GET /public/v1/scans/{sbom_id}`
`get_scan_status`	`GET /public/v1/scans/status`
`submit_scan`	`POST /public/v1/scans`

Connecting a client

Point any MCP client that supports Streamable HTTP with custom headers at the endpoint. For example, with Claude Code:

claude mcp add ossprey --transport http https://api.ossprey.com/public/v1/mcp \
  --header "x-api-key: $OSSPREY_API_KEY"

Calling it directly

The endpoint is plain JSON-RPC, so you can drive it with curl:

# Discover the tools
curl -X POST "https://api.ossprey.com/public/v1/mcp" \
  -H "x-api-key: $OSSPREY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/list" }'

# Call one
curl -X POST "https://api.ossprey.com/public/v1/mcp" \
  -H "x-api-key: $OSSPREY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 2,
    "method": "tools/call",
    "params": { "name": "list_scans", "arguments": {} }
  }'

Malformed JSON or an invalid JSON-RPC request returns a 400 carrying a standard JSON-RPC error envelope.