Connect Aevrin MCP

Aevrin MCP is a hosted MCP server at https://api.mcp.aevrin.net/mcp. Your agent asks it for a capability and gets one of two answers: either Aevrin runs the capability on its own servers and returns the output, or Aevrin returns the instructions an administrator wrote and your agent carries them out on your machine. Every capability was reviewed and approved by an Aevrin administrator before it could be published. Your agent can also ask Aevrin to scan an MCP server and read the report.

Running a capability on Aevrin's servers is not available yet; searching, reading a capability, getting its instructions and scanning work now. See Tools for what each tool returns and Limits for how capability reads, runs and scans are counted.

What you need

• An Aevrin account. The Free plan is enough.
• An Aevrin API key. aevrin login stores one on your machine, or create one under Settings → API keys on the dashboard. It is the same kind of key the CLI uses; there is no separate Aevrin MCP key.

Every request to the endpoint carries the key as a bearer token, Authorization: Bearer aevrin_.... There is no anonymous access.

Quickest: the connect dialog

On the dashboard, open Integrations and click Connect your AI (it is also the first step when you sign up). Pick your client: Claude Code, Claude Desktop, Cursor, VS Code, Windsurf, Cline, Gemini CLI, Codex CLI, or any MCP client. Then:

1. Click Make my key. Aevrin makes a new API key named "Aevrin MCP key" and puts it inside every snippet in the dialog.
2. Follow your client's steps. Cursor and VS Code have a one-click install button. Agents like Claude Code can also take one pasted prompt and set themselves up, ending with a free search_capabilities call to prove it works.
3. Try it: ask your agent what Aevrin tools it has.

If you would rather not have the key in a config file at all, use the CLI below instead.

By hand: let the CLI supply the key

Install the CLI and log in once (see Installation):

pipx install aevrin
aevrin login

Then add Aevrin MCP to Claude Code:

claude mcp add-json --scope user aevrin '{"type":"http","url":"https://api.mcp.aevrin.net/mcp","headersHelper":"aevrin mcp-header"}'

aevrin mcp-header prints {"Authorization":"Bearer <your key>"} and nothing else. It finds the key the same way every CLI command does: AEVRIN_API_KEY when it is set, otherwise ~/.aevrin/credentials. Claude Code runs it each time it connects, so the key is never written into Claude Code's configuration, and after you log in again the next session uses the new key. If there is no key, the command writes an error to stderr and exits non-zero, and Claude Code reports the connection as failed.

--scope user makes Aevrin MCP available in every project, and lets Claude Code run the helper without a per-project trust prompt. Start a new session after adding it: Claude Code loads MCP servers only when a session starts.

By hand: a static header

For a client that cannot run a helper command, put the key in the configuration directly:

claude mcp add --scope user --transport http aevrin https://api.mcp.aevrin.net/mcp \
  --header "Authorization: Bearer aevrin_your_key"

For a client configured with JSON:

{
  "mcpServers": {
    "aevrin": {
      "type": "http",
      "url": "https://api.mcp.aevrin.net/mcp",
      "headers": { "Authorization": "Bearer aevrin_your_key" }
    }
  }
}

The key is then stored in plain text in that client's configuration file. Create a key just for this under Settings → API keys, so you can revoke it without logging the CLI out, and never commit the file.

What a 401 means

The endpoint answers 401 Unauthorized with WWW-Authenticate: Bearer before any MCP traffic when the header is missing, or the key is malformed, unknown or revoked. All four cases get the same answer on purpose, so a response never tells anyone which keys exist. To fix it:

1. Run aevrin mcp-header in a terminal. If it prints an error, run aevrin login.
2. With a static header, check that the whole key was copied and that it is not revoked under Settings → API keys.
3. Reconnect from /mcp in Claude Code, or start a new session.

A key revoked during a session can still list the tools for up to a minute, but every tool call is refused with "This Aevrin API key is invalid or revoked."

Two other refusals are worth knowing, and neither looks the way you might expect:

• The account is not active. A disabled or blocked account looks like any other failed connection: the session check answers 403, so the transport refuses the key with the same 401 as a bad one. You only see the tool error "This Aevrin account cannot use Aevrin MCP." if the key was already cached as valid, which lasts up to a minute. Write to ujjwal@aevrin.net if you think that is wrong.
• Aevrin could not check your account. This is a 503 with Retry-After: 5, never a 401 and never a pass: a check Aevrin cannot complete refuses the call rather than allowing it. Try again shortly.

What Aevrin MCP does not do

• It shows only capabilities an Aevrin administrator has published. There is no public listing, and nobody else can add an item.
• It does not install anything into your agent or change your agent's configuration. When a capability's answer is instructions rather than a run, your agent does that work on your machine with your own privileges, outside Aevrin's sandbox, the same as anything else you ask it to do.
• It does not run anything on your machine. scan_mcp_server scans a public GitHub repository or a live server's https URL on Aevrin's servers. To scan a command or a local folder, use aevrin scan or the local aevrin mcp-server, which run on your machine.