MCP server for AI agents

The ten tools an AI agent can use, the risk class of each, and the rules that keep agents safe.

Tools and risk classes

Tool	Risk class	Taints the key	What it does
`open_session`	`READ`	No	Opens a session bound to your agent key
`list_projects`	`READ`	No	Projects the key may see
`get_status`	`READ`	No	Status of a plan or a project
`read_logs`	`READ`	Yes	Logs for a project and environment, up to 500 lines
`inspect_request`	`READ`	Yes	One request by its ID
`query_rows`	`READ`	Yes	Up to 100 rows from one table. No free-form SQL
`read_webhook`	`READ`	Yes	One webhook delivery
`create_plan`	`REVERSIBLE`	No	1–20 changes. The plan’s own class decides who must approve
`request_export`	`REVERSIBLE`	No	Creates an export plan, which always needs a passkey approval
`apply_plan`	`IRREVERSIBLE`	No	Applies a plan that is allowed to run

There is no tool that reads a secret value, and none will be added.

Taint

The four tools that read customer content (read_logs, inspect_request, query_rows, read_webhook) taint the session and the agent key before they fetch anything, so even a failed read taints.
Content they return is wrapped in a boundary marker so an agent can tell it apart from instructions.
Taint on a key never wears off by itself. Only a person can clear it, and a new session inherits it.
A plan created while tainted stays tainted. Tainted production plans always need a person’s approval.

Limits

Each agent key can create 20 plans an hour (RATE_LIMITED after that).
After three refused or failed applies in a row, the key is paused and the owner is alerted. An owner, admin or the key’s owner can unpause it.
A key’s scope names its projects and the highest risk class it may apply. New keys default to READ with no projects.

Connecting

The server speaks MCP over streamable HTTP at POST /mcp, with JSON responses. Agent keys are bearer tokens of the form aak_<tenant>_<secret>; only a hash is stored. Browser origins must be on the allow-list.

Claude Code, against a server you run

claude mcp add --transport http aspian http://127.0.0.1:3820/mcp \
  --header "Authorization: Bearer $ASPIAN_AGENT_KEY"

Cursor (.cursor/mcp.json), against a server you run

{
  "mcpServers": {
    "aspian": {
      "url": "http://127.0.0.1:3820/mcp",
      "headers": { "Authorization": "Bearer ${env:ASPIAN_AGENT_KEY}" }
    }
  }
}

Errors come back as tool results with isError: true and a body of {"error": {"status", "code", "message"}}. Codes are listed in Errors.

NextTrust Page and verifying evidence