§ /mcp · streamable-http server

Audit a public URL from your AI client.

A Model Context Protocol server at /api/mcp exposes two tools (audit_url and get_quota) to compatible clients that support Streamable HTTP and bearer-token authentication. Same engine as the CLI and web app. Bearer-auth with the same key. No separate billing.

§ connect (claude desktop)

Add a custom remote connector in Claude's connector settings using https://app.nyman.media/api/mcp. Add the fixed request header Authorization with the value Bearer YOUR_NMS_API_KEY, then enable the connector for your conversation.

Get a key from Account settings → API access on the web app (Premium or Partner required). Production keys start with nms_live_; localhost and preview keys start with nms_test_. Organization-managed plans may require an owner to add the connector. Follow the current Claude remote connector instructions.

Connect from Claude Code

Scroll the code horizontally if needed.

claude mcp add --transport http nyman-media https://app.nyman.media/api/mcp \
  --header "Authorization: Bearer YOUR_NMS_API_KEY"

Follow the Claude Code HTTP setup instructions. More client and key-ownership details are in the full MCP guide.

§ use with a coding agent

Once connected, give your agent a bounded audit, fix, and verification workflow. The MCP server supplies audit evidence; the coding agent uses its own repository permissions for any file inspection or edits.

Audit https://example.com and inspect the evidence. For each actionable code finding, inspect this codebase and make the smallest safe fix. Summarize anything that needs content, infrastructure, or human review. Before re-auditing, have the changed code deployed to the audited public URL through our approved release process. If deployment is not authorized or complete, stop and report that verification is pending. Re-audit that URL only after the changed version is live. Report the new evidence and any unresolved findings.

§ tools exposed

audit_url

Run the full readiness engine on a URL. Returns the full comparable score, hard_block status, and findings for the two crawl-access sections. A share_url is included for persisted site-level runs, subject to public report eligibility. Counts against your daily audit quota.

get_quota

Introspect the current key: tier, daily limit, remaining audits, and shared quota status. Reading quota never consumes an audit slot.

§ why

The MCP server exposes only audit_url and get_quota. It does not read or change a repository. A compatible coding agent can use the audit evidence alongside the repository access you grant that client, make a bounded fix, and call NM Signals again after the changed version is deployed to the audited URL. A re-audit of the old deployment cannot verify a local code change.

§ same engine, every surface

clinms audit https://example.com
restPOST /api/v1/audits
mcptools/call audit_url
webrun an audit at nyman.media

full docs →cli →rest api →pricing →