01
A VerdictIQ API key
Free tier monthly quota, no credit card. Sent as the X-API-Key header: scriptable, easy to rotate from the portal. Start Free → Open the portal →
MCP SERVER · NEW
Run VerdictIQ from your AI host.
Connect Claude, Cursor or any MCP-compatible client to VerdictIQ. Paste a URL, paste your key, you're done. Nothing to install.
Hosted by VerdictIQPaste URL, connect in secondsOAuth coming soon
WHAT IS MCP
Same verdicts, no HTTP.
MCP (Model Context Protocol) is the open standard for giving AI hosts a tool list. Drop VerdictIQ in, and Claude or Cursor can call our verdicts directly, in plain English.
Use HTTP API when…
Production SOAR or SIEM playbooks. Deterministic batch jobs. Audit-logged automated decisions.
Use MCP when…
Interactive triage in Claude or Cursor. Ad-hoc IOC questions during incident. AI-assisted detection engineering.
Learn more about MCP on the official spec site.
BEFORE YOU START
Two things, one minute.
No binary, no Docker, no npx. MCP and HTTP share the same key and the same quota.
02
An MCP host
Claude Desktop, Cursor, Cline, VS Code, Continue, Zed, Windsurf, or anything that speaks MCP over SSE.
- Coming soonOAuth sign-in. One-click connect, coming soon. Required for ChatGPT Apps SDK.
- MSSPMulti-tenant. MSSP workspaces propagate via the X-Customer-Id header on every tool call.
CONNECT
Pick your host. Paste one block.
Same endpoint, same key. Each host wraps it in its own JSON shape, that is the only difference. Claude Desktop is the most common starting point.
JSON
{
"mcpServers": {
"verdictiq": {
"url": "https://mcp.verdictiq.io/mcp/sse",
"headers": {
"X-API-Key": "sk_REPLACE_ME"
}
}
}
}Quit and reopen Claude Desktop (Cmd-Q on macOS); just closing the window is not enough. The plug menu shows verdictiq with a green dot and its tools listed.
Verify
Ask your AI host: "Use verdictiq to check the domain example.com". The host should call enrich and return a verdict with a score and the top signals.
AVAILABLE TOOLS
Four tools, one conversation away.
Each tool wraps a single VerdictIQ endpoint. Same response shape as the HTTP API.
IOC Enrichment
Score one IOC. Returns the verdict, signals and evidence.
Score the domain example.com
Bulk IOC Enrichment
Score up to 10 000 IOCs in a single call.
Check these 50 IOCs from yesterday's SIEM export.
Signal Catalog
Browse the full signal taxonomy: direction, family, group and severity for every label.
What signals exist for domain IOCs?
Signal Reference
Plain-language names and descriptions for every signal, with service mappings.
What does the newly-activated domain signal mean?
TROUBLESHOOTING
Common questions.
Eight short answers for the things that usually go sideways on the first try.
No green dot in Claude Desktop
Validate the JSON: jq . claude_desktop_config.json. Confirm the URL is exactly https://mcp.verdictiq.io/mcp/sse. Endpoint health: curl https://mcp.verdictiq.io/mcp/health returns 200 with status ok. Quit and reopen Claude (Cmd-Q), not just close the window.
Tool not called
Add an explicit hint in the prompt: "use verdictiq to check…". Claude can pass on tool calls when the choice is ambiguous. Cursor and Cline weight tool descriptions higher and call without a hint.
401 Unauthorized
Confirm the key is set under headers (X-API-Key), not as a URL parameter. Check the key is still active in the portal. Rotate if you suspect a leak.
Bulk limit exceeded
enrich_bulk caps at 10 000 indicators per call. For more, batch the input and chunk via the HTTP API.
Rate limited (429)
MCP calls share the HTTP API quota. Check usage in the portal. Upgrade the plan or wait for the next quota window.
Multiple workspaces or projects
Project-level configs (for example .cursor/mcp.json) override the global file. Different projects can run with different keys against the same endpoint.
Behind a corporate proxy
Most hosts honour HTTPS_PROXY. SSL inspection (corporate MITM) can break the TLS handshake; install your corporate CA into the system trust store.
mcp.verdictiq.io unreachable
SSE keeps a long-lived TCP connection on 443. If the firewall has a short idle timeout, the connection drops. Allow-list mcp.verdictiq.io and *.verdictiq.io. Cloud-only service: there is no alternate deployment.
Check usage in the portal →
curl https://mcp.verdictiq.io/mcp/health
# {"status":"ok"}Paste the URL. You're connected.
Free tier includes 2 000 calls per month. MCP and HTTP share the same quota.
TLS 1.3Cloud-hostedZero retentionSame quota as API
All product names are trademarks of their respective owners.