Connect your agent

Rustine’s MCP server lets your agent list your projects, start a scan, read the issues, get a fix and ask for a recheck. Rustine never edits your code: your agent applies the fix, on your machine.

Server address: https://mcp.rustine.io

Before you start: a plan that opens MCP (Pro, or the 14-day trial on Solo, see Access) and two-factor authentication turned on in Rustine.

With OAuth (recommended)

No key to copy. On the first call, your agent opens Rustine’s authorization page: you see the account and plan it will act on, you click Allow, and it renews its access by itself.

Agent	Where to add it	Step by step
Claude (claude.ai, app)	Customize › Connectors › Add custom connector, name Rustine, URL https://mcp.rustine.io	Help center (French)
ChatGPT	Plugins › + › custom MCP server, OAuth authentication	Help center (French)
Claude Code	claude mcp add --transport http rustine https://mcp.rustine.io, then /mcp	Help center (French)
Cursor	~/.cursor/mcp.json: { "mcpServers": { "rustine": { "url": "https://mcp.rustine.io" } } }
VS Code	.vscode/mcp.json: { "servers": { "rustine": { "type": "http", "url": "https://mcp.rustine.io" } } }

In the app, Settings › Connected agents copies the address and opens the right page for Claude and ChatGPT, and lists every connected agent with its last use.

With an API key

For an agent that cannot do OAuth. The key goes in the Authorization header, never in the address.

Agent	Configuration
Claude Code	claude mcp add --transport http rustine https://mcp.rustine.io --header "Authorization: Bearer $RUSTINE_API_KEY"
Cursor	{ "mcpServers": { "rustine": { "url": "https://mcp.rustine.io", "headers": { "Authorization": "Bearer ${env:RUSTINE_API_KEY}" } } } }
VS Code	"headers": { "Authorization": "Bearer ${input:rustine-key}" }, with an inputs entry of type promptString and password: true

OAuth or key? The help center compares both (in French). To call the server from a script, without an agent: From a script.

What to ask

1. “List my Rustine projects and their scores.”
2. “Scan mysaas.com with Rustine.”
3. “What are the security issues of mysaas.com, worst first?”
4. “Get the fix for the first one and apply it.”
5. “Recheck this issue with Rustine” (after your deploy).

The tools it calls, and what each one costs: The tools.