SwarmHawk MCP Server
Connect your AI assistant directly to your live domain security data. Ask Claude, Cursor, or any MCP-compatible tool to scan domains, surface breach risks, and explain findings — all from a single conversation.
Last updated March 2026 · MCP server: https://swarmhawk.com/api/mcp
What is MCP?
The Model Context Protocol (MCP) is an open standard created by Anthropic that lets AI assistants call external tools and data sources in a structured, sandboxed way. Think of it like a USB-C port for AI: any MCP-compatible client (Claude, Cursor, Windsurf, Cline…) can plug into any MCP server and immediately gain access to its tools.
When you connect the SwarmHawk MCP server to your AI tool, the assistant can read your live scan results, query domain risk scores, and explain findings — without you having to copy-paste data in or out. The AI operates on your real, current security posture, not a stale export.
What the AI can do via MCP:
- List all your domains and their current risk scores
- Fetch the full scan report for any domain, including every finding
- Trigger a fresh scan on demand
- Get aggregate statistics across your entire portfolio
- Check scanner pipeline health
Security model: The MCP server is read-mostly. Your AI assistant cannot delete domains, modify your account, or change billing. The only write action is trigger_scan, which requires explicit confirmation.
Prerequisites
| Item | Required? | Where to get it |
|---|---|---|
| SwarmHawk API key | ✓ Yes | Dashboard → Account tab → API Key |
| SwarmHawk Pro or higher plan | ✓ Yes | Free tier does not include API access |
| Claude Desktop app | For Claude Desktop setup | claude.ai/download |
| Cursor IDE ≥ 0.42 | For Cursor setup | cursor.com |
| Windsurf IDE | For Windsurf setup | codeium.com/windsurf |
| VS Code + Cline extension | For Cline setup | marketplace.visualstudio.com |
Server URL & Auth
All clients point to the same server endpoint:
https://swarmhawk.com/api/mcp
Authentication is a Bearer token sent in the Authorization header, or in the apiKey / api_key field depending on the client. Your API key is available in the dashboard Account tab. Keys never expire but can be regenerated.
Setup by Client
Pick your AI tool below for the exact configuration steps.
claude_desktop_config.json at the path for your OS:mcpServers object.{
"mcpServers": {
"swarmhawk": {
"type": "http",
"url": "https://swarmhawk.com/api/mcp",
"headers": {
"Authorization": "Bearer YOUR_API_KEY"
}
}
}
}
Claude.ai (web) supports MCP connections via Project settings → Connected tools. This feature is available on Claude Pro and Team plans.
Cursor supports MCP via a workspace-level .mcp.json file or global settings. Requires Cursor ≥ 0.42.
.mcp.json in your project root{
"servers": {
"swarmhawk": {
"url": "https://swarmhawk.com/api/mcp",
"headers": {
"Authorization": "Bearer YOUR_API_KEY"
}
}
}
}
.mcp.json file. Or add the server globally so it's available in all projects.list_domains and return ranked results.Windsurf (by Codeium) supports MCP via its Cascade AI feature. Configure once in Settings and the tools are available globally.
{
"name": "swarmhawk",
"endpoint": "https://swarmhawk.com/api/mcp",
"auth": {
"type": "bearer",
"token": "YOUR_API_KEY"
}
}
Cline is a VS Code extension that supports MCP tools. Install Cline from the VS Code Marketplace, then configure SwarmHawk in the Cline settings JSON.
cline_mcp_settings.json.{
"mcpServers": {
"swarmhawk": {
"url": "https://swarmhawk.com/api/mcp",
"apiKey": "YOUR_API_KEY"
}
}
}
If you need to run the MCP server inside a private network or want to customize it, you can self-host the SwarmHawk MCP adapter using Python.
Note: Self-hosting is for advanced users. The hosted server at swarmhawk-backend.onrender.com/mcp is always up-to-date and requires no maintenance on your part.
pip install mcp fastapi uvicorn httpx
# Minimal SwarmHawk MCP proxy
import os, httpx
from mcp.server.fastmcp import FastMCP
API = "https://swarmhawk.com/api"
KEY = os.environ["SWARMHAWK_API_KEY"]
HEADERS = {"Authorization": f"Bearer {KEY}"}
mcp = FastMCP("swarmhawk")
@mcp.tool()
async def list_domains():
"""Return all domains with risk score and scan status."""
r = httpx.get(f"{API}/domains", headers=HEADERS)
return r.json()
@mcp.tool()
async def get_scan_result(domain: str):
"""Full findings for a specific domain."""
r = httpx.get(f"{API}/scan-results/{domain}", headers=HEADERS)
return r.json()
if __name__ == "__main__":
mcp.run(transport="sse")
SWARMHAWK_API_KEY=swh_xxx python swarmhawk_mcp.py
http://localhost:8000/mcp instead of the hosted URL.All 9 MCP Tools
Once connected, your AI assistant has access to these tools. You don't call them directly — just ask a question and the AI picks the right tool automatically.
How tool selection works: You don't need to name tools in your prompt. If you ask "which of my domains are at risk?", the AI calls list_domains, filters for score > 30, and summarises. If you ask about compliance, it calls get_compliance_status. The AI chains multiple tools when needed.
Example Prompts
These prompts work across all MCP-compatible clients. The AI automatically selects the appropriate tool(s).
Security overview
Remediation help
Compliance
Operations
Troubleshooting
Most common cause: the config file has a JSON syntax error or the server URL has a typo. Validate the JSON at jsonlint.com. The URL must be exactly https://swarmhawk.com/api/mcp — no trailing slash.
Also check you restarted the client fully (not just closed the window) after editing the config.
Your API key is missing, malformed, or belongs to a Free tier account. Check:
- The key is in the config exactly as shown in your Account tab (starts with
swh_) - The header value is
Bearer swh_your_key— the word "Bearer" followed by a space must be included - Your SwarmHawk plan is Pro or higher — Free accounts do not have API access
If list_domains returns an empty array, you haven't added any domains to your SwarmHawk account yet — go to the dashboard and add one. If the data looks old, trigger a fresh scan via the dashboard or ask the AI to call trigger_scan.
The backend runs on Render's free tier which spins down after 15 minutes of inactivity. The first request after a cold start takes 20–40 seconds. Subsequent requests are fast. Enterprise plans are hosted on always-on infrastructure.
This is intentional for trigger_scan (the only write operation). For read-only tools, Claude should call them without confirmation. If you're seeing confirmation prompts for reads, check your Claude Desktop or project settings — there may be a "require approval for all MCP tools" setting enabled.
MCP is designed for interactive AI use. For automated pipelines, use the REST API directly instead — it's simpler, has no AI overhead, and gives you full programmatic control. See the API section of the Knowledge Base for full documentation and code examples.
Getting Your API Key
YOUR_API_KEY.Never share your API key. Do not commit it to version control. Do not paste it in public chat. If it's compromised, go back to the Account tab and click Regenerate — the old key is immediately invalidated.
Last updated March 2026 · swarmhawk.com · Knowledge Base · Privacy