Connecting to the ObservePoint MCP Server
Overview
MCP (Model Context Protocol) is an open standard that lets an AI assistant connect to other tools and work with their data. The ObservePoint MCP Server is that connection for your ObservePoint account. Once it's set up, you can ask your assistant things like "What Audits are running right now?" and get answers from your real account data, without opening the app.
It's not a new account or a separate system. You sign in with your normal ObservePoint credentials on ObservePoint's own login page, and your assistant only gets the access your existing role already has. Your password is never seen or stored by your AI client, and you can disconnect at any time to cut off access immediately. For anything that creates or deletes items, or runs a scan against your quota, your assistant will typically check with you first.
Before You Start
You'll need an ObservePoint account and an MCP-compatible AI client. The steps below cover the most common clients. The connection method is the same standard OAuth flow no matter which one you use.
Adding the Server
The setup steps are a little different for each client. The easiest thing is to tell your agent to connect it for you. Here's a prompt you can copy and paste:
Help me connect the ObservePoint MCP server to this AI client.
Start by reading the setup guide:
https://help.observepoint.com/en/articles/16299323-connecting-to-the-observepoint-mcp-server
If you can't open that page, use these details:
- Name: ObservePoint
- URL: https://mcp.observepoint.ai/v1
- Auth: OAuth 2.1 with PKCE and Dynamic Client Registration (no API key or client ID to enter)
Then:
1. Work out which client you are (e.g. Claude Code, Cursor, VS Code, Codex, ChatGPT, Claude.ai). If you can't tell, ask me.
2. Add the server using that client's standard method for remote HTTP MCP servers. If you can edit config or run commands yourself, do it. If this client only supports adding connectors through its settings UI, give me exact click-by-click steps. Don't guess at config formats; check the client's current documentation if you're unsure.
3. Tell me when I need to act. The first connection opens a browser window where I sign in to ObservePoint (or through SSO) and approve access. I'll do that myself.
4. Verify the connection by asking ObservePoint which Audits I have running. Tell me whether it returned real account data.
Rules:
- Never ask for my ObservePoint password, and don't put credentials or tokens in any config file or in this chat. Authentication happens only on ObservePoint's own login page.
- If something fails, check the troubleshooting section of the guide before trying anything else. If I get "Role may not call this tool," that's a permissions issue for my ObservePoint admin, not a setup problem.
- If my AI workspace needs an admin to enable MCP servers, tell me, and give me a short message I can send to them.
If that doesn't work, you may need the admin of your AI assistant to enable the MCP for you. Here are the details:
Name: ObservePoint
URL: https://mcp.observepoint.ai/v1
The ObservePoint MCP uses Dynamic Client Registration (DCR)
Signing In
The first time you use the server, your client opens a browser window and takes you to an ObservePoint sign-in screen. Log in with your normal ObservePoint credentials, or your SSO provider where it's supported, and approve the connection.
The MCP Server uses a standard OAuth 2.1 flow with PKCE:
Your client asks the server what's required to connect, and gets pointed to ObservePoint's authorization service.
A browser window opens to a real ObservePoint login page.
You log in and approve the connection.
Your client receives a short-lived access token, which it presents on every request.
Tokens refresh automatically in the background. You shouldn't need to log in again unless you disconnect, your access is revoked, or your session has been inactive long enough to expire.
Your ObservePoint password is never seen by, or stored in, your AI client. Only ObservePoint's own login page ever sees it.
Permissions
Access follows your existing ObservePoint role. An admin account gets more tools (managing users, for example); a standard account is scoped accordingly. You don't need to configure this. It's inherited automatically from your ObservePoint login.
Try It Out
Ask your assistant something like "What Audits do I have running right now?" If you get a real answer back with your actual account data, you're connected.
Security Notes
All ObservePoint credentials are handled by ObservePoint's own login page, never entered into or stored by your AI client.
Access tokens are short-lived and refresh automatically. Disconnecting the integration cuts off further use right away.
Best Practices
Be specific about scope. "Check the homepage Audit" is faster and more accurate than "check my Audits" when you have a lot running.
Use names or IDs when you have them. It avoids ambiguity when multiple items have similar names.
Review before bulk or destructive actions. For anything that creates, deletes, or runs a scan against your scan quota, the assistant typically confirms scope with you first. Take a moment to check it before approving.
Be mindful of what you share in prompts. Avoid pasting sensitive customer data like PII or credentials into your chat. Describe the issue instead and let the assistant pull the relevant data directly from ObservePoint.
Troubleshooting
What you see | What's happening | What to do |
Asked to log in again unexpectedly | Your access token expired or was revoked | Sign in again through the prompt. |
"Your ObservePoint credential was rejected" | The stored credential is no longer valid | Reconnect the integration to trigger a fresh login |
"This account uses SSO; password login isn't supported here" | Your account requires SSO login | Use your organization's SSO option on the ObservePoint sign-in screen instead of a password |
A request errors with a timeout | The underlying API call is taking longer than expected | Try narrowing the request: a smaller date range, fewer pages, or a specific Audit instead of "all Audits" |
A response looks cut off | Very large results get truncated automatically to keep things readable | Ask for a narrower slice of the data, or ask for a summary instead |
"Role may not call this tool" | Your ObservePoint account role doesn't have permission for that action | Check with an ObservePoint admin on your team about your account's role |
Repeated failures on the same request | The underlying API may be rate-limiting or temporarily unavailable | The assistant retries automatically a few times. If it still fails, wait a moment and try again |
Limits to Be Aware Of
Large reports or Audit results are capped in size per request and get truncated with a note if you exceed it. Ask for a narrower query if this happens.
Report queries return between 10 and 10,000 rows per page.
HAR file analysis supports up to 15 files per upload, 300MB each.
Running a full Audit scan uses your account's scan quota. Re-checking Rules against an existing run doesn't.