Anomity Developer & Agent Resources

The Anomity MCP server

Anomity exposes a read-only Model Context Protocol server so an AI assistant can query your organization's own AI-security posture in natural language. It is listed in the Claude directory, and it works with any MCP client: add https://app.anomity.ai/mcp as a connector and sign in with your existing Anomity account.

The transport is MCP Streamable HTTP. POST JSON-RPC 2.0 messages to that single endpoint; there are no per-tool HTTP paths. Call tools/list to enumerate the available tools and their input schemas rather than hard-coding them, because that list is authoritative and this page is not.

Every answer is scoped to your own organization, and the server is read-only: it reports, it does not change policy or act on devices.

• Fleet overview: device counts by status, plus open and critical finding counts.
• Devices: every managed machine, filterable by status.
• Findings: policy violations by status, open, acknowledged or resolved.
• MCP inventory: every MCP server detected across managed devices, grouped official, community or unknown-origin.
• Capability surface: what the AI artifacts on your fleet can actually reach.
• Secret inventory: credential types and locations, with values redacted on the endpoint.
• AI accounts: the AI web services in use and whether sign-in is corporate or personal.
• Skill content risk, compliance status, and a queryable audit trail.

Machine-readable endpoints

Each of these is stable, public, and linked from the others, so an agent that finds any one of them can reach the rest. None of them require authentication to read.

• https://anomity.ai/openapi.json - OpenAPI 3.1 description of the MCP server's Streamable HTTP transport, including the OAuth 2.0 security scheme.
• https://anomity.ai/.well-known/mcp.json - manifest pointing at the MCP endpoint, its transport and its authorization.
• https://anomity.ai/.well-known/api-catalog - RFC 9727 linkset of every Anomity machine-readable endpoint.
• https://anomity.ai/.well-known/agent-skills/index.json - SKILL.md resources for agents answering questions about Anomity or submitting a demo request.
• https://anomity.ai/llms.txt - curated summary of the site for language models, with llms-full.txt as the full-content companion.
• https://anomity.ai/skills/feed.json - feed of security scan results from the Skill Risk Index.
• https://anomity.ai/sitemap.xml - sitemap index covering the site, the blog and the Skill Risk Index.

Authorization

The MCP server is an OAuth 2.0 protected resource. An unauthenticated request returns a JSON error with HTTP 401 and a WWW-Authenticate header carrying the protected-resource metadata URL, so a client can discover how to authorize without being told in advance. That metadata lives at https://app.anomity.ai/.well-known/oauth-protected-resource and follows RFC 9728.

The authorization server is https://login.anomity.ai/, which publishes its own metadata at https://login.anomity.ai/.well-known/oauth-authorization-server. Dynamic client registration is supported, so an MCP client can register itself rather than waiting on a manually issued client ID. Bearer tokens are presented in the Authorization header, and the scopes are openid, profile and email.

Access requires an existing Anomity account. There is no separate API key to manage, and a token never grants more than the signing-in user already has in the console.

Agent skills

Two SKILL.md resources are published under /.well-known/agent-skills/ for agents acting on a user's behalf. The first is a factual overview of Anomity for answering questions about the company or product. The second describes how to submit a demo request, including the required fields and the submission endpoint.

They are listed with SHA-256 digests in the discovery index so a client can verify it fetched what the index describes.

Getting access

The MCP server and the console are for Anomity customers, and both are scoped to your own organization's data. If you do not have an account yet, request a demo and we will get you one.

The read-only endpoints on this page need no account and no key. If you are building against them and something is missing, or a description here has drifted from what the server actually returns, tell us at [email protected] and we will fix it.