Overview
Axur MCP (Model Context Protocol) is a native integration that allows AI models to securely access information from the Axur platform through an API.
Prerequisites
Before starting the configuration, the user must:
Have access to the Axur platform.
Generate an API Key at:
Use an MCP-compatible client.
The following clients have currently been validated:
Claude Code
ChatGPT Codex
Gemini Antigravity/CLI
Official Documentation
The official Axur MCP documentation is available at:
Security Best Practices
Never enter your API Key directly into an AI prompt.
The recommended approach is to ask the assistant to generate a configuration file (mcp_config.json or .mcp.json, depending on the client being used) and, only after the file has been created, manually enter the API Key in the corresponding field.
This approach prevents credentials from being shared during the conversation with the model and follows security best practices.
MCP Configuration Prompt
The prompt below has been validated for the compatible clients (Claude Code, ChatGPT Codex, Gemini Antigravity/CLI).
# MCP Configuration Task
Create or update the client's MCP configuration file (`mcp_config.json`) with all four Axur MCP endpoints using Streamable HTTP (SSE):
1. Threat Hunting: https://mcp.axur.ai/mcp/th/
2. Cyber Threat Intelligence (CTI): https://mcp.axur.ai/mcp/cti/
3. Risk Tickets: https://mcp.axur.ai/mcp/tickets/
# Server Headers Required
For every server entry, include the following headers:
- Authorization: Bearer <YOUR_AXUR_API_KEY>
- Content-Type: application/json
- Accept: application/json, text/event-stream
# Verification
Verify that the initialize handshake connects successfully to https://mcp.axur.ai/mcp/th/ and return a list of available tools.
After executing this prompt, the model should create the MCP configuration file. The <YOUR_AXUR_API_KEY> placeholder should then be replaced with the API Key generated in the Axur platform.
Testing the Integration
After completing the configuration, it is recommended to perform a simple search to verify that communication with the MCP server is working correctly.
The prompt below performs a Threat Hunting search using an example brand.
# Objective
Perform a Threat Hunting audit to detect high-impersonation threats targeting the brand: "[INSERT YOUR BRAND NAME]".
# Execution Instructions
1. Build Query: Use build_url_domain_query_tool with parameter impersonated_brands_high: "[INSERT YOUR BRAND NAME]".
2. Run Threat Search: Call search_urls_domains using the generated query impersonatedBrandsHigh="[INSERT YOUR BRAND NAME]" for top 10 results.
3. Inspect Credential Risks: Extract references, hostnames, WHOIS registrants, credential harvesting indicators, and ISP geolocations.
# Report Format
Return a structured executive threat report with a summary table containing:
- Reference URL
- Impersonated Level (High)
- Credential Harvesting Risk (Yes / No / Possibly)
- Domain Host & Registrar
- Geolocation / ISP
Replace [INSERT YOUR BRAND NAME] with the desired brand name before executing the query.
Expected Result
If the configuration is correct, the assistant should:
Successfully connect to the Axur MCP server;
Complete the initialize handshake;
List the available tools;
Execute queries on the platform using the configured API Key;
Return structured results according to the prompt.
Summary
Generate an API Key in the Axur platform.
Use a compatible client (Claude Code, ChatGPT Codex, Gemini Antigravity/CLI).
Execute the MCP configuration prompt.
Manually enter your API Key in the generated configuration file.
Execute the validation prompt to confirm that the integration is working correctly.