Connect an AI Assistant

HeaderHawk runs a hosted MCP server, so an AI assistant that supports remote MCP servers can read your account and answer questions about it: what broke this week, which scripts run on your payment page, whether checkout still sends its security headers. There is nothing to install. You add one URL to the assistant and sign in.

https://mcp.us.headerhawk.com/mcp

The steps for each assistant we have tested on production are on its own page: Claude, Claude Code, ChatGPT, Codex and Cursor. Other assistants that support remote MCP servers with OAuth sign-in follow the same steps: add the URL, sign in, and authorize.

Before you start

• Your plan. The MCP server is on the Professional plan and above.
• Your HeaderHawk account. Sign in to the dashboard at least once before connecting. The assistant signs you in as an existing member, and an address that has never opened the dashboard has no account to read.

What signing in grants

When you add the URL, the assistant opens HeaderHawk’s sign-in page in your browser. You sign in the way you do on the dashboard, then a screen titled “Connect HeaderHawk with” the assistant says it will be able to “Read your HeaderHawk reports, issues, scripts and scans”. Choosing Authorize grants that one permission, headerhawk:read:

• The assistant reads what a member with the viewer role can read, for the account you signed in to, whatever your own role is.
• It changes nothing. No tool creates, edits or deletes anything.
• It is yours. Each member who wants an assistant connects their own, and each connection is listed under their name.

What the assistant can see lists every tool and what it answers.

Unverified Application

An assistant that registers itself by Dynamic Client Registration, as Cursor does, names itself when it registers, so HeaderHawk cannot confirm who it is. Its consent screen carries a warning saying so. Check that the assistant named on the screen is the one you just added before you authorize it.

Disconnect an assistant

Every assistant you have connected is listed under Settings › API keys › Connected assistants, with when you connected it. Disconnect ends it: the assistant can no longer renew its access, and the access it already holds expires within 10 minutes.

If your account leaves a plan that includes the MCP server, every assistant stays connected but answers each question with the plan it needs. Nothing is deleted: when the plan comes back within 30 days, the connections work again without signing in. After 30 days, each assistant signs in again.

When something goes wrong

• The assistant cannot connect. Check the URL ends in /mcp, and that your browser could open the sign-in page it showed.
• It connects, then every question fails. The assistant says why: your account’s plan does not include the MCP server, or the address you signed in with is not a member of a HeaderHawk account yet. Either is fixed without connecting again: an owner changes the plan under Settings › Billing, or you sign in to the dashboard with the same address.
• It says to wait. Questions about your reports share a budget with your account’s API keys. The assistant is told how many seconds to wait.