Connecting to the ObservePoint MCP Server
Overview
Connect your AI assistant to your ObservePoint account, and you can run Audits, check Journey results, or pull a report by asking in plain language, without opening the ObservePoint app.
Before You Start
You'll need an ObservePoint account and an MCP-compatible AI client. The steps below cover the most common clients. The connection method is the same standard OAuth flow no matter which one you use.
Adding the Server
The setup steps are a little different for each client. You may need the admin of your AI assistant to enable the MCP for you. Here are the details:
Name: ObservePoint
URL: https://mcp.observepoint.ai/v1
The ObservePoint MCP uses Dynamic Client Registration (DCR)
Signing In
The first time you use the server, your client opens a browser window and takes you to an ObservePoint sign-in screen. Log in with your normal ObservePoint credentials, or your SSO provider where it's supported, and approve the connection.
The MCP Server uses a standard OAuth 2.1 flow with PKCE:
Your client asks the server what's required to connect, and gets pointed to ObservePoint's authorization service.
A browser window opens to a real ObservePoint login page.
You log in and approve the connection.
Your client receives a short-lived access token, which it presents on every request.
Tokens refresh automatically in the background. You shouldn't need to log in again unless you disconnect, your access is revoked, or your session has been inactive long enough to expire.
Your ObservePoint password is never seen by, or stored in, your AI client. Only ObservePoint's own login page ever sees it.
Permissions
Access follows your existing ObservePoint role. An admin account gets more tools (managing users, for example); a standard account is scoped accordingly. You don't need to configure this. It's inherited automatically from your ObservePoint login.
Try It Out
Ask your assistant something like "What Audits do I have running right now?" If you get a real answer back with your actual account data, you're connected.
Security Notes
All ObservePoint credentials are handled by ObservePoint's own login page, never entered into or stored by your AI client.
Access tokens are short-lived and refresh automatically. Disconnecting the integration cuts off further use right away.
Best Practices
Be specific about scope. "Check the homepage Audit" is faster and more accurate than "check my Audits" when you have a lot running.
Use names or IDs when you have them. It avoids ambiguity when multiple items have similar names.
Review before bulk or destructive actions. For anything that creates, deletes, or runs a scan against your scan quota, the assistant typically confirms scope with you first. Take a moment to check it before approving.
Be mindful of what you share in prompts. Avoid pasting sensitive customer data like PII or credentials into your chat. Describe the issue instead and let the assistant pull the relevant data directly from ObservePoint.
Troubleshooting
What you see | What's happening | What to do |
Asked to log in again unexpectedly | Your access token expired or was revoked | Sign in again through the prompt. |
"Your ObservePoint credential was rejected" | The stored credential is no longer valid | Reconnect the integration to trigger a fresh login |
"This account uses SSO; password login isn't supported here" | Your account requires SSO login | Use your organization's SSO option on the ObservePoint sign-in screen instead of a password |
A request errors with a timeout | The underlying API call is taking longer than expected | Try narrowing the request: a smaller date range, fewer pages, or a specific Audit instead of "all Audits" |
A response looks cut off | Very large results get truncated automatically to keep things readable | Ask for a narrower slice of the data, or ask for a summary instead |
"Role may not call this tool" | Your ObservePoint account role doesn't have permission for that action | Check with an ObservePoint admin on your team about your account's role |
Repeated failures on the same request | The underlying API may be rate-limiting or temporarily unavailable | The assistant retries automatically a few times. If it still fails, wait a moment and try again |
Limits to Be Aware Of
Large reports or Audit results are capped in size per request and get truncated with a note if you exceed it. Ask for a narrower query if this happens.
Report queries return between 10 and 10,000 rows per page.
HAR file analysis supports up to 15 files per upload, 300MB each.
Running a full Audit scan uses your account's scan quota. Re-checking Rules against an existing run doesn't.