OpenRouting
Sign in
Sign inGet started

Docs · MCP server

Ask your AI assistant about your security findings

OpenRouting is a remote MCP server. Connect ChatGPT or Claude with a sign-in, or Claude Code, Gemini CLI, Cursor, VS Code and other tools with your API key, and your assistant can search findings, read a verdict and its fix, set a finding's status or start a scan.

$ claude mcp add --transport http openrouting https://openrouting.si/mcp
✓ sign in approve in your browser
✓ read repos · sites · scans · findings
✓ write start scans · set finding status
scans spend credits; you approve write access
$

Why use it from your assistant

Triage from chat

Ask about a finding and get its AI verdict, the plain-English explanation and the suggested fix without leaving your assistant or editor.

Ask what's critical

"What's open and high or critical in this repo?" Search findings by severity, status or scanner across repositories, websites and API suites.

Start scans

Start a repository scan or a passive website scan from a conversation. The tool states its credit cost, so your assistant should ask you first.

Mark false positives

Ask to set a finding to false positive, accepted risk or fixed, with a note. You confirm it in the dashboard, and it lands in the same triage history.

Safe by design

New API keys are read-only, hiding a finding waits for your confirmation, untrusted text is labelled and redacted, and a workspace switch turns all access off.

Free to read

Reading findings and changing their status costs nothing. Only the scans an assistant starts spend credits, at dashboard prices.

Connect your tool

Server URL: https://openrouting.si/mcp (Streamable HTTP). Connect a repository, website or API suite first so the assistant has something to read. Pick your tool:

ChatGPT

Works (sign in with OAuth)
  1. In ChatGPT's settings, turn on Developer mode.
  2. Add a custom MCP server (connector) with https://openrouting.si/mcp as the server URL and OAuth as the authentication.
  3. Sign in to OpenRouting, review the consent screen and approve read, and optionally write, access.
  4. Developer mode is available on eligible ChatGPT plans only, and ChatGPT's menu names change from time to time.
New connectorNameOpenRoutingMCP server URLhttps://openrouting.si/mcp1AuthenticationOAuth2Create, then sign in3
Illustrative: our own drawing of where the settings go, not a screenshot. Field names can differ between versions.
  1. Server URL: the OpenRouting MCP endpoint.
  2. Auth type: OAuth. There is no key to paste.
  3. ChatGPT sends you to OpenRouting to sign in and approve read, and optionally write, access.

Claude

Works (sign in with OAuth)
  1. In Claude on the web or desktop, open Customize (or Settings) → Connectors and choose Add custom connector.
  2. Enter a name, for example OpenRouting, and https://openrouting.si/mcp as the server URL.
  3. Sign in to OpenRouting, review the consent screen and approve read, and optionally write, access.
  4. Custom connectors depend on your Claude plan.
Add custom connectorNameOpenRoutingRemote MCP server URLhttps://openrouting.si/mcp1Add, then Connect2
Illustrative: our own drawing of where the settings go, not a screenshot. Field names can differ between versions.
  1. Server URL: the OpenRouting MCP endpoint.
  2. Auth: Connect opens OpenRouting's sign-in and consent screen (OAuth). No key needed.

Claude Code

API key or OAuth
  1. With an API key: run the command below in a terminal.
  2. With OAuth instead: run the same command without the --header part, then run /mcp in Claude Code and choose openrouting to sign in.
  3. Check the connection with /mcp; openrouting should show as connected.

Terminal

claude mcp add --transport http openrouting https://openrouting.si/mcp \
  --header "Authorization: Bearer <your API key>"

Replace <your API key> with your API key (see below).

Terminal$ claude mcp add --transport http \1 openrouting https://openrouting.si/mcp \2 --header "Authorization: Bearer or_key_…"3> /mcp openrouting · connected
Illustrative: our own drawing of where the settings go, not a screenshot. Field names can differ between versions.
  1. Transport: http (Streamable HTTP).
  2. Server URL: the OpenRouting MCP endpoint, named openrouting.
  3. Your API key, sent as a Bearer token in the Authorization header. Leave the --header part out to sign in with OAuth through /mcp instead.

Gemini

API key or OAuth
  1. Gemini CLI: add the server below to ~/.gemini/settings.json (or run /mcp auth openrouting to use OAuth instead of the header), then restart the CLI and run /mcp to check it.
  2. If you use Antigravity, add the server to ~/.gemini/config/mcp_config.json instead: the same entry, but with "serverUrl" in place of "httpUrl".
  3. The Gemini app and Google AI Studio can't connect to custom MCP servers: not supported by Google.
  4. Gemini Enterprise: not yet. It needs an admin-issued OAuth client, which OpenRouting doesn't offer yet. Using an API key header there is not verified.

~/.gemini/settings.json

{
  "mcpServers": {
    "openrouting": {
      "httpUrl": "https://openrouting.si/mcp",
      "headers": {
        "Authorization": "Bearer <your API key>"
      }
    }
  }
}

Replace <your API key> with your API key (see below).

~/.gemini/settings.json{ "mcpServers": { "openrouting": { "httpUrl": "https://openrouting.si/mcp",1 "headers": { "Authorization": "Bearer or_key_…"2} } }
Illustrative: our own drawing of where the settings go, not a screenshot. Field names can differ between versions.
  1. Server URL goes in httpUrl. In Antigravity (~/.gemini/config/mcp_config.json) the same field is serverUrl.
  2. Your API key, sent as a Bearer token in the Authorization header.

Cursor

API key
  1. Open Cursor Settings → MCP → Add new global MCP server; this opens ~/.cursor/mcp.json.
  2. Add the server below and save. Use the API key header: it avoids the browser sign-in round trip.
  3. The openrouting server should turn green in the MCP list.

~/.cursor/mcp.json

{
  "mcpServers": {
    "openrouting": {
      "url": "https://openrouting.si/mcp",
      "headers": {
        "Authorization": "Bearer <your API key>"
      }
    }
  }
}

Replace <your API key> with your API key (see below).

~/.cursor/mcp.json{ "mcpServers": { "openrouting": { "url": "https://openrouting.si/mcp",1 "headers": { "Authorization": "Bearer or_key_…"2} } }
Illustrative: our own drawing of where the settings go, not a screenshot. Field names can differ between versions.
  1. Server URL goes in url.
  2. Your API key, sent as a Bearer token in the Authorization header.

VS Code

API key or OAuth
  1. Run MCP: Open User Configuration from the Command Palette (your user mcp.json, so the key stays out of the repository).
  2. Add the server below and save, then start it from the MCP: List Servers command.
  3. With OAuth instead: leave out the headers block; VS Code asks you to sign in when the server starts.

mcp.json (user configuration)

{
  "servers": {
    "openrouting": {
      "type": "http",
      "url": "https://openrouting.si/mcp",
      "headers": {
        "Authorization": "Bearer <your API key>"
      }
    }
  }
}

Replace <your API key> with your API key (see below).

mcp.json (user configuration){ "servers": { "openrouting": { "url": "https://openrouting.si/mcp",1 "type": "http",2 "headers": { "Authorization": "Bearer or_key_…"3} } }
Illustrative: our own drawing of where the settings go, not a screenshot. Field names can differ between versions.
  1. Server URL goes in url.
  2. Transport: type http.
  3. Your API key, sent as a Bearer token in the Authorization header.

Other tools

API key
  1. Add a remote (Streamable HTTP) MCP server with the URL below and an Authorization header carrying your API key.
  2. API key or OAuth: Codex, Zed, Goose and Copilot Studio.
  3. API key header: Cline, JetBrains AI Assistant and Windsurf.
  4. Anything not listed here is not verified: if it can send a custom header to a remote MCP server, the API key should work.
  5. Keep the key in your user configuration or an environment variable, never in a file you commit.
  6. A new key is read-only. Turn on Allow writes in Dashboard → AI assistants (MCP) if the assistant should start scans or change finding status.
ToolWhere the URL and key go
CodexAPI key or OAuthIn ~/.codex/config.toml add [mcp_servers.openrouting] with url = "<server URL>" and bearer_token_env_var = "OPENROUTING_API_KEY", then put your key in that environment variable. Codex sends it as the Authorization header.
ZedAPI key or OAuthAdd the server under context_servers in Zed's settings.json with its url and an Authorization header.
GooseAPI key or OAuthAdd a remote extension of type streamable_http with the URL and an Authorization header.
Copilot StudioAPI key or OAuthAdd an MCP server tool with the URL and choose OAuth 2.0 with Dynamic discovery, then sign in. Not verified: API key authentication with an Authorization header carrying Bearer and your key.
ClineAPI keyIn Cline's MCP settings add the server with "type": "streamableHttp", the url and an Authorization header.
WindsurfAPI keyIn Windsurf's mcp_config.json put the URL in "serverUrl" and the key in an Authorization header.
JetBrains AI AssistantAPI keyNot verified: add a remote MCP server in the AI Assistant's MCP settings with the URL and an Authorization header.

MCP config (most tools use this shape)

{
  "mcpServers": {
    "openrouting": {
      "url": "https://openrouting.si/mcp",
      "headers": {
        "Authorization": "Bearer <your API key>"
      }
    }
  }
}

Replace <your API key> with your API key (see below).

Add remote MCP serverTransportStreamable HTTP1Server URLhttps://openrouting.si/mcp2Header nameAuthorization3Header valueBearer or_key_…3
Illustrative: our own drawing of where the settings go, not a screenshot. Field names can differ between versions.
  1. Transport: Streamable HTTP (sometimes called http or streamableHttp).
  2. Server URL: the OpenRouting MCP endpoint.
  3. Your API key, sent as a Bearer token in the Authorization header.

API key

API key
  1. Every MCP request carries your key in the Authorization header, as below.
  2. The key acts as you in this workspace. A new key is read-only: to let an assistant start scans or change a finding's status, turn on Allow writes in Dashboard → AI assistants (MCP). You can disable it at any time.
  3. Optional: set it to expire after 30, 90 or 365 days, and limit it to the IP addresses or ranges you use. A key that has expired, or is used from another address, is refused.
  4. Marking a finding false positive, accepted risk or fixed is never applied straight away: the assistant gets a link, and the change happens only when you confirm it in the dashboard within 24 hours.
  5. Lost it? Regenerate: the old key stops working at once and the new one is shown once.

HTTP request headers

POST https://openrouting.si/mcp
Authorization: Bearer <your API key>
Content-Type: application/json
Accept: application/json, text/event-stream

Replace <your API key> with your API key (see below).

HTTP requestPOST /mcp HTTP/1.11Host: openrouting.si1Authorization: Bearer or_key_…2Content-Type: application/jsonAccept: application/json, text/event-stream
Illustrative: our own drawing of where the settings go, not a screenshot. Field names can differ between versions.
  1. Server: https://openrouting.si/mcp.
  2. Your API key as a Bearer token. Get it in the dashboard under AI assistants (MCP).

Where to get your API key

  1. Sign in and open Dashboard → AI assistants (MCP).
  2. The first time, click Reveal and copy the key. It is shown once: until then it is also kept encrypted, and after that OpenRouting keeps only its hash.
  3. Lost it, or think it leaked? Click Regenerate. The old key stops working at once and the new one is shown once.
  4. Paste it where your tool’s guide above shows <your API key>, after Bearer.

A new key is read-only. On the same page you can allow writes (scans and status changes), set an expiry, limit it to your IP addresses, disable it, see its activity and turn MCP off for the whole workspace. ChatGPT and Claude don’t need the key: they connect with a sign-in.

Tools and what they cost

Read tools are free. Write tools spend credits or change triage, and their descriptions state the cost, so your assistant should ask you before it uses one.

ToolCredits
get_workspaceRead · Show your workspace and credit balance.Free
list_repositoriesRead · List connected repositories with their latest scan.Free
list_targetsRead · List website targets for passive scanning.Free
list_api_suitesRead · List imported API suites.Free
search_findingsRead · Search one repository's, website's or API suite's findings by severity, status or scanner.Free
get_findingRead · Read one finding with its AI verdict, explanation, suggested fix and triage history.Free
list_scansRead · List recent scans for a repository, target or suite.Free
get_scanRead · Read one scan's status and summary.Free
start_repository_scanWrite · Start a full scan of a connected repository. The assistant should ask you first.20 (up to 30 with agent review)
start_website_scanWrite · Start a passive scan of a website target. The assistant should ask you first.10
update_finding_statusWrite · Reopen a finding, or ask to mark it false positive, accepted risk or fixed, with an optional note. Hiding it waits for your confirmation in the dashboard.Free

Security notes

Sign-in or API key

ChatGPT and Claude connect with OAuth 2.1 and PKCE. Your assistant sends you to OpenRouting, you sign in with your existing account, and a consent screen names the app, the workspace it will see and the host you will be sent back to. An app that registered itself is labelled "Unverified app", because anyone can choose any name. No key changes hands.

Tools that can't do that sign-in well use your personal API key instead. Prefer OAuth where your tool supports it: an API key is a bearer secret, so anyone who has it can act as you until you disable or regenerate it.

Your API key

Each user has one key. It is stored as a hash; until you first reveal it, it is also kept encrypted so it can be shown once. After that only the hash remains. Keep it in your user configuration or an environment variable, never in a file you commit. A new key is read-only: turn on Allow writes if an assistant should start scans or change finding status. Disable it, or regenerate it: the old key stops working at once.

You can also set the key to expire after 30, 90 or 365 days (regenerating it starts a new period) and limit it to up to 20 IP addresses or CIDR ranges. An expired key, or one used from an address outside its list, is refused.

Read and write scopes

Read covers every read tool. Write covers the tools that spend credits or change triage: start_repository_scan, start_website_scan and update_finding_status. On the consent screen write is ticked and you can untick it; an API key is read-only until you turn on Allow writes. Without write, a write tool tells the assistant it isn't allowed.

Hiding a finding needs your confirmation

When an assistant marks a finding false positive, accepted risk or fixed, nothing changes yet. It gets a link to a confirmation page in the dashboard, which shows the finding, the change, the app that asked and its note. Only you, signed in to the same workspace, can confirm or cancel it, within 24 hours. Reopening a finding applies at once.

Tokens

OAuth access and refresh tokens are random, opaque strings, and OpenRouting stores only their hashes. An access token lasts one hour. A refresh token lasts 30 days and is replaced every time it is used; if a used refresh token is presented again, the whole connection is revoked. Revoking an app, reconnecting it or deleting your account invalidates every token issued before.

Workspace switch and isolation

A workspace switch under AI assistants (MCP) turns MCP off for everyone in the workspace: every key and every connected app is refused until it is turned back on. While it is off, apps connected with sign-in (ChatGPT, Claude and others) can't refresh their tokens (the refresh is answered invalid_grant), so reconnect them after you turn MCP back on. The workspace always comes from the key or token, never from a tool argument, so an assistant cannot ask for another workspace's data. GitHub tokens, raw scanner output and website verification tokens are never returned.

Untrusted content

Findings quote your code, website responses, imported API files and model output. Anyone who can change those can put text in front of your assistant, including text written to look like instructions (prompt injection). Every field that carries such text is named untrusted_*, and before it is sent invisible characters are stripped, known key and token formats and secret-named values are redacted and long text is clipped. The server tells the assistant to treat those fields as data.

Your assistant still decides what to do with what it reads. Check any scan it proposes before you approve it, and revoke connections you no longer use.

Rate limits and activity

Each key or connection can make 60 tool calls a minute and 10 write calls an hour. AI assistants (MCP) → Activity lists tool calls and key changes with their outcome; it never records the arguments or results.

Revoke access

AI assistants (MCP) → Connected apps in the dashboard lists every app connected with sign-in; click Revoke and its tokens stop working immediately. To cut off your API key, disable or regenerate it.

Not available over MCP

Adding repositories or websites, pull request review, reports, agent setup pull requests, API suite import and analysis, and buying credits stay in the dashboard. Active website scanning is not offered anywhere, and an assistant cannot open pull requests or change your code.

Common questions

Do I need an OpenRouting account?

Yes. Every connection, by sign-in or API key, acts as you in your workspace. There is no anonymous access.

Should I use sign-in or an API key?

Sign-in (OAuth) where your tool supports it: ChatGPT and Claude only offer that. Claude Code, Gemini CLI and VS Code can do either. Cursor and tools that only send headers use the API key. A key is a bearer secret, so keep it out of repositories.

Where do I find my API key?

Dashboard → AI assistants (MCP). Reveal shows it once. It is stored as a hash; until you first reveal it, it is also kept encrypted so it can be shown once, and after that only the hash remains. If you lose it, regenerate it and the old key stops working.

Can I use it from the Gemini app or Google AI Studio?

No. Google doesn't let them connect to custom MCP servers. Gemini CLI and Antigravity work with the API key. Gemini Enterprise is not supported yet.

Is it listed in the ChatGPT or Claude connector directory?

No. You add it as a custom connector by URL: https://openrouting.si/mcp.

Which ChatGPT plans can use it?

Custom connectors in ChatGPT need Developer mode, which OpenAI offers on eligible plans only. If you can't find Developer mode in ChatGPT's settings, your plan or workspace doesn't have it. Custom connectors in Claude also depend on your plan; Claude Code connects with one command.

Does connecting cost credits?

No. Reading is free, and so is changing a finding's status. Only the scans an assistant starts spend credits, at the same prices as the dashboard, and failed scans are refunded the same way.

Can the assistant change my code?

No. It can read findings, start a scan and change a finding's status. It cannot open pull requests, edit repositories or see your GitHub token.

Is the content it reads safe to follow as instructions?

No. Findings contain text from your code, websites and API files, which anyone with access to them could have written. The server labels that text as untrusted and redacts known key and token formats and secret-named values in it, but your assistant still reads it, so treat anything in it that looks like an instruction with suspicion.

How do I disconnect?

Open AI assistants (MCP) in the dashboard. Revoke a connected app, or disable or regenerate your API key; access stops immediately. The workspace switch there turns MCP off for everyone.

Security

How we handle your code, secrets, tokens and API keys.

Read →

Connecting AI assistants safely

OAuth versus API keys, split scopes and untrusted labels.

Read →

Pricing

What each action costs in credits.

Read →