When to use MCP
Use the MCP server when a person is connecting Crawle to an AI assistant or agent platform and needs consent, scopes, and workspace-aware access.
- Use the server URL https://api.crawle.io/mcp when adding Crawle as a remote MCP connector.
- Authenticate with OAuth when the agent platform asks to connect Crawle.
- Approve only the scopes needed for the workflow, such as workspaces:read, sites:read, issues:read, exports:write, or alerts:write.
- Use technology:read for stack/risk context and technology:write only when agents may run scans or update technology finding state.
- Reconnect the connector after scope changes so the agent receives the updated grant.
Workspace context
Workspace context is explicit so agencies can use one account across multiple client workspaces without leaking data between them.
- Ask the agent to list workspaces before inspecting sites.
- Use the workspace-switching tool before site-level calls when you belong to multiple workspaces.
- Confirm the current workspace context before running write operations.
- Use separate conversations or explicit context prompts when switching between client workspaces.
Useful agent prompts
MCP works best when the request is specific about workspace, site, severity, time window, and desired output.
- List critical issues for crawle-demo.io and group them by template or URL pattern.
- Find broken internal links, include source pages, and suggest which links should be updated first.
- Summarize what changed on this site during the last 24 hours and separate open from resolved incidents.
- Prepare a migration QA checklist from current redirects, 404s, canonicals, and indexability issues.
- Check the detected technology stack for this site and summarize any high-confidence exposed-version risks.
API keys for scripts
API keys are still useful for server-side scripts, scheduled jobs, and integrations that do not involve an interactive user.
- Create keys from settings only when a script cannot use OAuth.
- Grant the narrowest scopes needed and keep keys workspace-scoped.
- Store keys in a secret manager, never in a repository or browser client.
- Rotate keys when teammates, vendors, or automation ownership changes.