MCP Integration

Connect an MCP client to FullHunt’s hosted Streamable HTTP endpoint. The client must support a custom X-API-KEY request header, or an authentication method explicitly supported by FullHunt.

Prerequisites

A FullHunt API key from profile settings
An MCP client that supports Streamable HTTP
The account modules required by the tools you intend to call

Environment	Endpoint
Standard	`https://fullhunt.io/api/v1/mcp`
Dedicated Enterprise	`https://enterprise-api.fullhunt.io/api/v1/mcp`

Cursor

Cursor reads MCP configuration from one of these files:

Project: .cursor/mcp.json
User: ~/.cursor/mcp.json

Use the user-level file for credentials so an API key is not committed with a project.

~/.cursor/mcp.json

{
  "mcpServers": {
    "fullhunt": {
      "url": "https://fullhunt.io/api/v1/mcp",
      "headers": {
        "X-API-KEY": "YOUR_FULLHUNT_API_KEY"
      }
    }
  }
}

Restart or reload Cursor after changing the configuration. Then verify the connection with this prompt:

Call auth_status and return only the authentication status, plan, and remaining credit fields.

Do not commit a configuration file containing a real API key. Restrict file permissions and rotate the key if it is exposed.

Claude and Claude Desktop

Claude’s current remote integration flow is managed through Settings > Connectors. The legacy claude_desktop_config.json instructions are for local command-based servers and should not be used to configure this hosted FullHunt endpoint. FullHunt currently authenticates the hosted endpoint with X-API-KEY. Use Claude directly only when the connector flow available to your account supports FullHunt’s authentication method. Otherwise, use a compatible client such as Cursor or an approved local bridge that injects the header server-side.

Do not place a FullHunt API key in a connector URL, prompt, or chat message.

Custom clients

Configure a Streamable HTTP transport and attach the API key to every request:

MCP client settings

{
  "name": "fullhunt",
  "transport": "streamable-http",
  "url": "https://fullhunt.io/api/v1/mcp",
  "headers": {
    "X-API-KEY": "YOUR_FULLHUNT_API_KEY"
  }
}

Clients should support the MCP POST, GET, and DELETE lifecycle methods used by Streamable HTTP. They should also preserve the session identifier returned by the server when the transport requires it.

Enterprise endpoint

Enterprise customers with dedicated infrastructure can use:

Enterprise MCP client settings

{
  "name": "fullhunt-enterprise",
  "transport": "streamable-http",
  "url": "https://enterprise-api.fullhunt.io/api/v1/mcp",
  "headers": {
    "X-API-KEY": "YOUR_ENTERPRISE_API_KEY"
  }
}

Using the Enterprise endpoint does not grant Enterprise tools by itself. Entitlements are evaluated from the API key.

Verification sequence

Verify authentication

Call auth_status. A successful response confirms that the endpoint received a valid API key.

Test a passive lookup

Ask the client to call fullhunt_domain_details for a domain in your authorized scope. Confirm that the client identifies the exact tool it used.

Check gated tools

Call one Enterprise, Nexus, or OEM tool only if your account includes that module. A 403 response usually indicates an entitlement issue.

Troubleshooting

Symptom	Likely cause	Action
Connection fails before tools are listed	Invalid URL, unsupported transport, or blocked network request	Confirm the endpoint and Streamable HTTP support
`401 Unauthorized`	Missing or invalid `X-API-KEY`	Check the header and verify the key through the REST `/auth/status` endpoint
`403 Forbidden`	Tool requires a module the account does not have	Review plans and capabilities
Tool is not found	Stale client tool cache or wrong name	Reload the client and compare against the 63-tool reference
`429 Too Many Requests`	Route or account limit reached	Back off and review rate limiting
A prompt does not call FullHunt	The client selected another tool or answered from model context	Name the FullHunt tool and ask the client to show tool-call evidence

Security checklist

Keep the API key in a user-level secret store or configuration file.
Do not commit keys, paste them into prompts, or send them through client analytics.
Review tool calls before allowing active scan tools.
Apply account and network controls outside the model where possible.
Retain audit logs for OEM or downstream write actions.

Get Started

Integration Foundations

Core Attack Surface

Search & Intelligence

Enterprise APIs

Nexus APIs

OEM APIs

Public APIs

Generated API Reference

Agentic AI (MCP)

Prerequisites

Cursor

Claude and Claude Desktop

Custom clients

Enterprise endpoint

Verification sequence

Troubleshooting

Security checklist

​Prerequisites

​Cursor

​Claude and Claude Desktop

​Custom clients

​Enterprise endpoint

​Verification sequence

​Troubleshooting

​Security checklist

Prerequisites

Cursor

Claude and Claude Desktop

Custom clients

Enterprise endpoint

Verification sequence

Troubleshooting

Security checklist