Before registering the server, run export GRIDINSOFT_API_KEY="YOUR_GRIDINSOFT_API_KEY" with your own key. Keep it available whenever you launch Claude.
Register the server
Run the command below. User scope makes Inspector available across projects. The saved configuration reads the key from Claude’s environment.
Start a fresh Claude session
Open /mcp and confirm that gridinsoft is connected. Existing entry? Remove it with claude mcp remove gridinsoft before registering again.
CONFIGURATIONRun in your terminal · macOS / LinuxShell
The 120,000 ms tool timeout accommodates URL scans. On Windows, use the JSON below in a project’s .mcp.json, set $env:GRIDINSOFT_API_KEY="YOUR_GRIDINSOFT_API_KEY" in PowerShell, then start Claude there.
Windows configuration +
Use this version so Windows launches npx through cmd /c. Keep the path and restart steps above.
Create ~/.codex/config.toml if it does not exist. On Windows, use %USERPROFILE%\.codex\config.toml.
Add the server
Merge the block below into the file and replace the API key placeholder locally. Update an existing mcp_servers.gridinsoft block instead of duplicating it.
Reload the connection
Start a new CLI session or restart the server in the app’s MCP settings. The CLI, desktop app and IDE use the configuration on their execution host.
Use ~/.hermes/config.yaml on macOS, Linux or WSL2; %LOCALAPPDATA%\hermes\config.yaml on native Windows. If you set HERMES_HOME, use that directory. Merge under the existing mcp_servers section.
Add Inspector and your key
Replace the placeholder in the private local config. Explicitly passing env matters: Hermes filters the environment inherited by MCP subprocesses.
Reload MCP
Start hermes chat or run /reload-mcp in the current session. The same configuration works on native Windows; Hermes resolves npx through its managed runtime.
Hermes timeouts are in seconds. If you keep secrets in the private .env file beside config.yaml, use GRIDINSOFT_API_KEY: "${GRIDINSOFT_API_KEY}" in the config instead. Native Windows guide ↗
✓
Check the connection. Free.
hermes mcp test gridinsoft checks connectivity. Ask Hermes to call mcp_gridinsoft_get_balance.
In Claude Desktop, go to Settings → Developer → Edit Config. This is the chat app’s local MCP configuration.
Add Inspector
Merge the entry into claude_desktop_config.json and replace the API key placeholder locally. On macOS the file is in ~/Library/Application Support/Claude/; on Windows, %APPDATA%\Claude\.
Quit and reopen Claude
Fully quit the application, reopen it and check the local connector status. Start a new chat with Inspector enabled.
Claude Desktop does not document an adjustable host tool timeout. For long URL scans, use a client with the 120-second setting shown here. Linux desktop users can choose Claude Code.
Windows configuration +
Use this version so Windows launches npx through cmd /c. Keep the path and restart steps above.
Open ~/.copilot/mcp-config.json (Windows: %USERPROFILE%\.copilot\mcp-config.json). In current VS Code, choose MCP: Add Server → Command (stdio) → Global → Copilot Global.
Merge the entry
Add Inspector under mcpServers and replace the key locally. This format is shared with Copilot CLI. Keep normal tool approvals enabled.
Restart the connection
Start a new Copilot CLI session, or in VS Code use MCP: List Servers → gridinsoft → Restart Server. Remote sessions need Node and the key on their execution host.
This is the current Copilot format. Older VS Code Local sessions use .vscode/mcp.json with a servers wrapper instead; follow the VS Code format reference for that mode.
Windows configuration +
Use this version so Windows launches npx through cmd /c. Keep the path and restart steps above.
copilot mcp list checks registration. Ask Copilot to call get_balance to verify the key.
Merge entries into your existing configuration. Replace YOUR_GRIDINSOFT_API_KEY only on your machine; keep keys out of shared repositories. The client starts the adapter for you. These recipes use the published 1.0.7 package and were checked against official client documentation.
03 / A SMALL, FOCUSED TOOLKIT
Five MCP tools for security research.
One Inspector API key connects the set. Your agent selects a tool and returns its structured result to the conversation.
3 credits / call
inspect_domain
A domain’s available reputation, verdict, category, and report reference. Use the result for domain triage and investigation.
INPUT{ "domain": "example.com" }
TWO NAMES. THE SAME DOMAIN CHECK.
check_domain_safety3 credits
get_domain_reputation3 credits
These aliases use the same analysis and response as inspect_domain.
10 credits / call
scan_url
Analyze an HTTP or HTTPS page. Read its metadata, available security signals, and redirect information.
INPUT{ "url": "https://example.com" }
◷
A scan can take up to 90 seconds. Set your client’s tool timeout to at least 120 seconds where configurable.
Free
get_balance
See your remaining credits, subscription plan, and subscription end date. A useful first call after connecting.
INPUT{}
↳
Verify your API key and account connection without spending credits.
Unknown ≠ safe. Missing assessment data is reported as unknown, so your agent can explain uncertainty.
Prompts and reference. Two free prompts and a category reference help the agent interpret the results.
An Inspector account, your API key, Node.js 22 or newer, and an agent that supports stdio MCP servers. View client configurations above and add the configuration to its MCP settings.
How does authentication work?+
The local adapter reads your GRIDINSOFT_API_KEY environment variable and authenticates requests to Inspector over HTTPS. Use the key from your profile. Keep it in your local configuration or secret store, out of source control.
Can I try it for free?+
The free plan includes 100 credits per month. A domain check costs 3 credits and a URL scan costs 10. Checking your balance, reading prompts, and reading the category reference are free. Explore API plans for more capacity.
Can I use a remote MCP server URL?+
Use the local @gridinsoft/mcp-inspector package with stdio. The /mcp/v1 HTTP routes are the REST bridge used by that package, not a Streamable HTTP or SSE MCP server endpoint.
Why can a URL scan take longer?+
A URL scan analyzes the live page and can take up to 90 seconds. Allow at least 120 seconds for tool calls in your client where supported. If a request times out, check your balance before retrying; a submitted scan may still complete.
Does a result guarantee that a website is safe?+
No. Assessments reflect available evidence and can change. An Unknown verdict or a null score means there is insufficient assessment data. Your agent should surface that uncertainty along with the findings.
{ }FOR CUSTOM INTEGRATIONSExplore the REST bridge referenceEndpoints, authentication, and request formats.+
REST API for Custom Integrations
The endpoints below are the JSON REST bridge used by the npm package. Connect MCP clients through the stdio configuration above; /mcp/v1 is a base path, not a Streamable HTTP or SSE endpoint. Public discovery endpoints need no API key. Tool calls and saved contexts require Authorization: Bearer YOUR_API_KEY. Send POST bodies as JSON with Content-Type: application/json.
BASE URLhttps://inspector.gridinsoft.com/mcp/v1
Endpoint
Method
Description
/tools
GET
List available security tools. PUBLIC
/tools/call
POST
Execute a security tool. PRIVATE
/models
GET
Describe the Inspector analysis service. PUBLIC
/prompts
GET
List available suggested prompt templates. PUBLIC
/prompts/get
GET
Render a prompt using name and arguments[site] or arguments[domain]. PUBLIC
/resources
GET
List available MCP resources. PUBLIC
/resources/read
GET
Read the content of a specific resource. PUBLIC
/health
GET
Check the REST bridge response; this does not run a scan. PUBLIC
/contexts
GET
List saved analysis contexts. PRIVATE
/contexts/create
POST
Create a new context. PRIVATE
/contexts/get
GET
Retrieve a specific context. PRIVATE
/contexts/update
POST
Update an existing context. PRIVATE
/contexts/delete
POST
Delete a context using JSON {"id":"CONTEXT_ID"}. PRIVATE
Tool call body: {"name":"inspect_domain","arguments":{"domain":"example.com"}}. Successful tool calls return a content array containing the JSON result as text. Context endpoints are REST features and are not exposed as MCP tools.
Domain Check API Details
The domain/check endpoint provides a fast security assessment by merging real-time scans with GridinSoft's historical database.