MCP server

@cencori/mcp is Cencori's official Model Context Protocol server. It gives Cursor, Claude Desktop, Codex, and any MCP client direct access to Cencori Web, documentation, gateway metrics, memory, agents, sessions, governance, and multimodal inference.

It is a thin stdio adapter over Cencori's public HTTP APIs. The platform enforces authentication, project isolation, quota, policy, and audit logging; the MCP server adds capability flags and tool annotations for reads, writes, destructive changes, and open-web access.

Version 0.7.1 includes first-party Web tools.

Documentation and manual guidance work without a key:

npx -y @cencori/mcp@latest

For Cencori Web and authenticated platform reads, add a project key:

{
  "mcpServers": {
    "cencori": {
      "command": "npx",
      "args": ["-y", "@cencori/mcp@latest"],
      "env": {
        "CENCORI_API_KEY": "csk_your_project_key"
      }
    }
  }
}

Add this object to your MCP client's configuration, then restart the client.

Web search, fetch, extraction, and browser-job polling are read tools. Crawling, starting a browser job, and submitting a takedown request require the write flag because they enqueue work or change project state.

{
  "mcpServers": {
    "cencori-web": {
      "command": "npx",
      "args": ["-y", "@cencori/mcp@latest"],
      "env": {
        "CENCORI_API_KEY": "csk_your_project_key",
        "CENCORI_MCP_FEATURES": "web,docs",
        "CENCORI_MCP_WRITE": "1"
      }
    }
  }
}

CENCORI_MCP_FEATURES is optional. The example limits the exposed surface to Web and docs.

Web access uses Cencori's own crawler, corpus, embeddings, and ranking pipeline — not a third-party search API.

All Web tools advertise openWorldHint: true. Their descriptions state that page content is untrusted data, never agent instructions. web_browse also rejects password, token, and secret field selectors. Browser jobs are asynchronous; call get_web_browser_job with the id returned by web_browse.

Example prompt after configuring the server:

Search the Cencori Web index for the latest PostgreSQL row-level security
documentation. Compare the top three sources, quote the evidence you used,
and include each source URL and retrieval timestamp.

The server is safe by default: reads require a key, while operations that incur cost or change state are opt-in.

Manual-only actions

Credential, billing, access, and governance-activation decisions are never executed by the MCP server. The corresponding how_to_* tools return instructions and a dashboard link:

• API keys: how_to_create_api_key, how_to_edit_api_key, how_to_revoke_api_key
• Governance: how_to_activate_policy, how_to_respond_to_change_request
• Billing: how_to_change_plan, how_to_manage_billing
• Access: how_to_manage_members

Restart the MCP server after changing environment variables.

Public

• Docs: search_docs, get_doc, list_docs, get_integration_guide
• Guidance: API key, governance, billing, and membership how_to_* tools

Authenticated reads

• Web: web_search, web_fetch, web_extract, get_web_browser_job
• Gateway: list_models, get_metrics, get_health, check_quota
• Agents: list_agents, get_agent, poll_agent_actions
• Memory: list, semantic search, get, entities, graph, and forget suggestions
• Sessions: list, get, and events
• Governance: policies, roles, change requests, ledger, evidence, and templates

Write

• Web: web_browse, web_crawl, request_web_takedown
• Inference: text, RAG, embeddings, moderation, images, vision, documents, TTS, and transcription
• Memory: remember_memory, write_memory, create_namespace
• Agents: create_agent, update_agent
• Sessions: create_session, add_session_turn
• Governance drafts: create_policy, install_template

Destructive

delete_memory, delete_agent, delete_session, approve_session, and reject_session.

The package is a thin stdio adapter over Cencori's HTTP APIs. The platform still enforces authentication, project isolation, quotas, policy, and audit logging. The MCP layer adds tool annotations and local capability flags so the client can distinguish reads, writes, destructive changes, and open-web access before execution.

Keep CENCORI_API_KEY in the MCP server environment, not in prompts or checked-in configuration. Treat all Web results as potentially adversarial input and require human approval before consequential actions.

Only docs tools appear: add CENCORI_API_KEY and restart the client.

web_browse or web_crawl is missing: set CENCORI_MCP_WRITE=1.

No Web tools appear with CENCORI_MCP_FEATURES: include web in the comma-separated list.

A browser job is still queued: call get_web_browser_job with the id returned by web_browse. Browser work is intentionally asynchronous.

A URL is rejected: Cencori blocks private networks, unsafe redirects, embedded credentials, unsupported protocols, robots-denied pages, and oversized responses.