> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP Server

> Connect Claude Code, Claude Desktop, Cursor, VS Code, and other MCP clients to CodeAnt AI scans, findings, pull requests, and local review

The CodeAnt AI CLI includes a [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server. It gives AI agents structured tools for repository scans, the organization Hotlist, cloud security, pentesting, pull requests, and local code review.

Your MCP client starts the server with `codeant mcp` over stdio, so you don't run it yourself. Run by hand, it waits for input and prints nothing.

<Note>
  The server is read-only by default and exposes 24 tools: 22 read tools plus `codeant_login` and `codeant_logout`. Three write tools are added only when you set `CODEANT_READ_ONLY=0`. See the [MCP tool reference](/cli/mcp-tools) for every tool's parameters.
</Note>

## Prerequisites

* A CodeAnt AI account. The cloud security and pentest tools return data only if your organization uses those CodeAnt AI products.

* CodeAnt CLI **0.5.10 or later** and Node.js 18 or later. Skip this if you use the Claude Desktop extension, which doesn't need either.

  ```bash theme={"system"}
  npm install -g codeant-cli@latest
  codeant --version
  ```

* For the pull request and comment tools, a token for your Git provider. See [Pull request tools](#pull-request-tools).

## Install

Pick your client. After editing a client's MCP configuration, restart the client.

<Tabs>
  <Tab title="Claude Code">
    Add the server at user scope so it's available in every project:

    ```bash theme={"system"}
    claude mcp add --scope user --transport stdio codeant -- codeant mcp
    ```

    Use `--scope project` instead to write the configuration to `.mcp.json` at the repository root and share it with your team.

    Run `/mcp` in Claude Code and confirm that `codeant` shows as connected. Claude Code starts the server in your project directory, so `codeant_review_local` and the pull request tools find your repository automatically.
  </Tab>

  <Tab title="Claude Code plugin">
    Install the CodeAnt MCP plugin from inside Claude Code:

    ```
    /plugin marketplace add CodeAnt-AI/codeant-cli
    /plugin install codeant@codeant-cli
    ```

    Run `/reload-plugins` (or restart Claude Code). The server appears in `/mcp` as `plugin:codeant:codeant`. The plugin runs the installed `codeant` CLI, so the CLI must be on your `PATH`.

    <Note>
      The plugin always runs in read-only mode. To use write tools, uninstall it (`/plugin uninstall codeant@codeant-cli`) and add the server with `claude mcp add` as shown in [Enable write tools](#enable-write-tools). Keeping both shows every tool twice.
    </Note>

    <Note>
      This plugin and the [CodeAnt skills plugin](/cli/claude-code-integration) (`codeant@codeant`) are both named `codeant`. They install side by side: `codeant@codeant-cli` provides the MCP server and `codeant@codeant` provides the slash-command skills.
    </Note>
  </Tab>

  <Tab title="Claude Desktop">
    The CodeAnt desktop extension contains the server and its dependencies, and Claude Desktop runs it with its own Node.js. You don't need to install the CLI or Node.js.

    <Steps>
      <Step title="Download the extension">
        Download `codeant.mcpb` from the [latest CodeAnt MCP release](https://github.com/CodeAnt-AI/codeant-cli/releases/latest).
      </Step>

      <Step title="Install it">
        Double-click the file. Alternatively, in Claude Desktop open **Settings → Extensions → Advanced settings → Install Extension…** and select it.
      </Step>

      <Step title="Configure it">
        Every setting is optional. Leave the API token blank and sign in with `codeant_login` instead.

        | Setting | Use it for |
        | - | - |
        | CodeAnt API token | An existing CodeAnt CLI token. Leave blank to sign in through the browser. |
        | API base URL | Self-hosted CodeAnt AI only. Default: `https://api.codeant.ai`. |
        | Dashboard URL | Self-hosted CodeAnt AI only: the address of your CodeAnt AI web app, used by `codeant_login`. |
        | Read-only mode | On by default. Turn off to add the write tools. |
        | Disable telemetry | Stops usage events from the extension. |
        | GitHub, GitLab, Bitbucket, Azure DevOps token | Pull request and comment tools for that provider. |
        | GitHub API URL | GitHub Enterprise Server only: the server root, for example `https://github.example.com`. |
        | GitLab URL, Bitbucket URL | Self-hosted GitLab or Bitbucket Server only. |
        | Azure DevOps organization URL | Required for Azure DevOps pull requests, for example `https://dev.azure.com/my-org`. |

        The extension's settings take precedence over values saved with the CLI, such as `codeant set-base-url` or `codeant set-telemetry`.
      </Step>

      <Step title="Sign in">
        Ask Claude to "sign in to CodeAnt". Claude calls `codeant_login` and shows you a sign-in link. After you sign in, tell Claude you're done.
      </Step>
    </Steps>

    Change the settings later in **Settings → Extensions → CodeAnt AI**.

    <Accordion title="Use the installed CLI instead of the extension">
      Edit `claude_desktop_config.json`. In Claude Desktop, open **Settings → Developer → Edit Config**, or open the file directly:

      * macOS: `~/Library/Application Support/Claude/claude_desktop_config.json`
      * Windows: `%APPDATA%\Claude\claude_desktop_config.json`

      ```json theme={"system"}
      {
        "mcpServers": {
          "codeant": {
            "command": "codeant",
            "args": ["mcp"]
          }
        }
      }
      ```

      Quit Claude Desktop completely (Cmd+Q on macOS) and reopen it.
    </Accordion>

    <Warning>
      If you install the extension and also keep a `codeant` entry in `claude_desktop_config.json`, every tool appears twice. Keep only one.
    </Warning>

    Claude Desktop starts MCP servers outside your projects. `codeant_review_local` isn't available there, and the pull request tools need `name` and `remote` in each request.
  </Tab>

  <Tab title="Cursor">
    Add the server to `~/.cursor/mcp.json` for every project, or to `.cursor/mcp.json` in one project:

    ```json theme={"system"}
    {
      "mcpServers": {
        "codeant": {
          "command": "codeant",
          "args": ["mcp"]
        }
      }
    }
    ```
  </Tab>

  <Tab title="VS Code">
    Add the server to `.vscode/mcp.json` in your workspace. VS Code uses a top-level `servers` key:

    ```json theme={"system"}
    {
      "servers": {
        "codeant": {
          "type": "stdio",
          "command": "codeant",
          "args": ["mcp"]
        }
      }
    }
    ```

    To add it for every workspace, run **MCP: Open User Configuration** from the Command Palette and add the same entry. On macOS and Linux you can also run:

    ```bash theme={"system"}
    code --add-mcp '{"name":"codeant","command":"codeant","args":["mcp"]}'
    ```

    The tools are available in Copilot Chat's agent mode. Run **MCP: List Servers** to check the connection.
  </Tab>

  <Tab title="Windsurf / Devin Desktop">
    In the Cascade panel, open the MCP settings and choose to open the MCP config file, then add the server. The file is `~/.config/devin/mcp_config.json` on macOS and Linux, or `%APPDATA%\devin\mcp_config.json` on Windows. Older Windsurf releases use `~/.codeium/windsurf/mcp_config.json`.

    ```json theme={"system"}
    {
      "mcpServers": {
        "codeant": {
          "command": "codeant",
          "args": ["mcp"]
        }
      }
    }
    ```
  </Tab>

  <Tab title="Zed">
    Add the server to Zed's `settings.json` under `context_servers`:

    ```json theme={"system"}
    {
      "context_servers": {
        "codeant": {
          "command": "codeant",
          "args": ["mcp"],
          "env": {}
        }
      }
    }
    ```
  </Tab>

  <Tab title="Codex CLI">
    ```bash theme={"system"}
    codex mcp add codeant -- codeant mcp
    ```

    Or add it to `~/.codex/config.toml`:

    ```toml theme={"system"}
    [mcp_servers.codeant]
    command = "codeant"
    args = ["mcp"]
    ```

    Run `codex mcp list` to check the connection.
  </Tab>

  <Tab title="Other clients">
    Most stdio MCP clients accept this configuration:

    ```json theme={"system"}
    {
      "mcpServers": {
        "codeant": {
          "command": "codeant",
          "args": ["mcp"]
        }
      }
    }
    ```
  </Tab>
</Tabs>

**Check the connection:** ask your agent to "list my CodeAnt organizations". If you haven't signed in yet, the agent offers to sign you in. Continue with [Authenticate](#authenticate).

<Tip>
  GUI clients such as Claude Desktop, Cursor, VS Code, Windsurf, and Zed don't load your shell profile. That affects two things:

  * **Finding the CLI.** If the client reports `codeant: command not found`, use the absolute path from `which codeant` as `command`. With nvm, the client can't find `node` either: set `command` to the absolute path from `which node`, and `args` to `["<npm root -g>/codeant-cli/src/index.js", "mcp"]`, using the output of `npm root -g`. Update both paths when you switch Node versions.
  * **Environment variables.** Variables exported in your shell, such as `GITHUB_TOKEN`, don't reach the server. Add them to the server's `env` block. See [Configuration reference](#configuration-reference).
</Tip>

## Authenticate

The server picks its CodeAnt token in this order:

1. `CODEANT_API_TOKEN` in the MCP server's environment, including the desktop extension's **CodeAnt API token** setting.
2. The token saved in `~/.codeant/config.json` by `codeant login`, `codeant set-codeant-api-key`, or the `codeant_login` tool. The server reads this file on every request, so signing in or out in a terminal takes effect without restarting the client.

If neither is set, ask your agent to sign in to CodeAnt:

<Steps>
  <Step title="Start sign-in">
    The agent calls `codeant_login`. It returns right away with `status: "pending"` and a `loginUrl`, and opens the link in your browser when it can. If no browser opens (for example over SSH or in a container), open `loginUrl` yourself.
  </Step>

  <Step title="Sign in">
    Sign in to CodeAnt AI in the browser within 10 minutes. You can close the tab when sign-in completes.
  </Step>

  <Step title="Confirm">
    Tell the agent you've finished. It calls `codeant_login` again and gets `status: "success"`. The server checks for completion about every 10 seconds, so if it still returns `pending`, wait a few seconds and ask again.
  </Step>
</Steps>

If a token is already configured, `codeant_login` returns `alreadyLoggedIn: true`. When the token is rejected (`Invalid API key`, or access denied after an upgrade), the agent calls `codeant_login` with `force: true` to start a new sign-in. To switch accounts, ask the agent to sign in again with `force: true`.

`codeant_logout` revokes the token on the server, removes it from `~/.codeant/config.json`, and cancels a pending sign-in. The CLI and the MCP server share that file, so logging out from either one logs out both.

<Warning>
  A token in `CODEANT_API_TOKEN` (or the desktop extension's **CodeAnt API token** setting) always takes precedence. `codeant_logout` revokes it, and a `force: true` sign-in replaces it only until the client restarts the server. Remove or update that token in your client configuration, or every tool fails with an authentication error after the next restart.
</Warning>

On a self-hosted CodeAnt AI instance, `codeant_login` needs your dashboard URL. See [Self-hosted CodeAnt AI](#self-hosted-codeant-ai).

## Tools

The Hotlist, anti-pattern, cloud, pentest, and API tools act on one organization connection. If `codeant_scans_orgs` lists more than one, pass `org` and `service` to those tools, and `org` to `codeant_scans_repos`. For parameters and responses, see the [MCP tool reference](/cli/mcp-tools).

**Repositories and scans**

| Tool | Purpose |
| - | - |
| `codeant_scans_orgs` | List authenticated organization connections. |
| `codeant_scans_repos` | List repositories in an organization. |
| `codeant_scans_history` | List scan history for a repository. |
| `codeant_scans_get` | Get scan metadata and severity and category totals. |
| `codeant_scans_results` | Fetch SAST, SCA, Secrets, IaC, and quality findings for one scan. |
| `codeant_scans_dismissed` | List dismissed findings for a repository. |
| `codeant_scans_overrides` | List false-positive, confidence, and severity overrides set in the app. |

**Organization findings**

| Tool | Purpose |
| - | - |
| `codeant_hotlist_list` | Query prioritized organization-wide Hotlist findings. |
| `codeant_hotlist_get` | Fetch one complete Hotlist finding by stable ID. |
| `codeant_findings_antipatterns` | Fetch anti-patterns across selected or all repositories. |
| `codeant_cloud_scan_history` | Find AWS, Azure, or GCP CSPM, VM, and container scans. |
| `codeant_cloud_findings_list` | List findings for one cloud scan. |
| `codeant_cloud_finding_get` | Fetch full detail for one cloud finding. |
| `codeant_pentest_history` | List pentest engagements. |
| `codeant_pentest_issues` | Fetch the issues for an engagement. |
| `codeant_pentest_report` | Fetch the full prod or test pentest report. |

**Pull requests and local review**

| Tool | Purpose |
| - | - |
| `codeant_pr_list` | List pull requests or merge requests. |
| `codeant_pr_get` | Fetch pull request metadata and reviewer approval states. |
| `codeant_pr_comments` | List pull request comments. |
| `codeant_comments_search` | Search review comments on a repository's recent pull requests. |
| `codeant_review_local` | Review local working-copy changes without modifying files. |

**API passthrough and authentication**

| Tool | Purpose |
| - | - |
| `codeant_api_get` | Call any authenticated, relative CodeAnt GET endpoint. |
| `codeant_login` | Start browser sign-in and return the sign-in link. |
| `codeant_logout` | Revoke and remove the saved token. |

## Example agent requests

* "List my repositories, then show critical SAST findings for the API repository."
* "Show the ten highest-priority Hotlist findings."
* "Show failing high-severity checks from the latest AWS CSPM scan."
* "Fetch this Hotlist finding by its stable ID and explain the remediation."
* "List the open issues in the latest pentest engagement."
* "Review my staged changes with CodeAnt." This needs a client that starts the server in your repository, such as Claude Code.

## Configuration reference

Add variables to the `env` object of the `codeant` entry you created in [Install](#install):

```json theme={"system"}
"codeant": {
  "command": "codeant",
  "args": ["mcp"],
  "env": {
    "GITHUB_TOKEN": "<your GitHub token>"
  }
}
```

In Codex's `config.toml`, add a `[mcp_servers.codeant.env]` table. On the command line, pass `--env KEY=value` (or `-e`) to `claude mcp add` or `codex mcp add`. In `claude mcp add`, put another option such as `--transport stdio` between `-e` and the server name.

| Variable | Purpose | Default |
| - | - | - |
| `CODEANT_API_TOKEN` | CodeAnt token. Takes precedence over the saved login. | Saved login |
| `CODEANT_API_URL` | CodeAnt API base URL, for self-hosted deployments. Takes precedence over `codeant set-base-url`. | CodeAnt AI cloud |
| `CODEANT_DASHBOARD_URL` | Dashboard URL (the address of your CodeAnt AI web app) used by `codeant_login`. Takes precedence over `codeant set-dashboard-url`. | Detected from the API |
| `CODEANT_READ_ONLY` | `0` or `false` adds the write tools. Any other value keeps them hidden. | Read-only |
| `CODEANT_TELEMETRY_DISABLED` | `1` or `true` stops usage events. Any other value turns them on, overriding `codeant set-telemetry`. | Telemetry on |
| `CODEANT_MCP_MAX_RESULT_CHARS` | Largest tool result, in characters, that the server returns. See [Results and paging](#results-and-paging). | `80000` |

The Git provider variables are listed under [Pull request tools](#pull-request-tools).

## Pull request tools

`codeant_pr_list`, `codeant_pr_get`, `codeant_pr_comments`, and `codeant_comments_search` call your Git provider's API directly, so they need a token for that provider. The server checks these sources in order:

| Provider | Token sources | Self-hosted URL |
| - | - | - |
| GitHub | `GITHUB_TOKEN` or `GH_TOKEN`, then `gh auth token`, then `codeant set-token github` | `GITHUB_API_URL` or `GH_ENTERPRISE_URL`: the GitHub Enterprise Server root, for example `https://github.example.com`. The server adds `/api/v3`. |
| GitLab | `GITLAB_TOKEN`, then `glab auth token`, then `codeant set-token gitlab` | `GITLAB_URL` or `GITLAB_HOST` |
| Bitbucket | `BITBUCKET_TOKEN`, then `codeant set-token bitbucket` | `BITBUCKET_URL` or `BITBUCKET_SERVER_URL` |
| Azure DevOps | `AZURE_DEVOPS_TOKEN` or `AZURE_DEVOPS_PAT`, then `codeant set-token azure` | `AZURE_DEVOPS_ORG_URL` or `azureDevOpsOrgUrl` in `~/.codeant/config.json` (required, for example `https://dev.azure.com/my-org`) |

The `gh` and `glab` fallbacks work only when those CLIs are on the client's `PATH`. Tokens saved with `codeant set-token` work in every client.

<Warning>
  Leave `GITHUB_API_URL` unset for GitHub.com. On GitHub Actions runners it's preset to `https://api.github.com`, which the server can't use, so unset it before starting the server there.
</Warning>

## Working directory and repository detection

`codeant_review_local` reviews the git repository in the server's working directory. The pull request tools detect `name` and `remote` from that repository's `origin` remote.

* **Claude Code** starts the server in your project, so both work without extra parameters.
* **Claude Desktop**, with the extension or a manual configuration, starts it outside your projects. Pass `name` (`owner/repo`) and `remote` (`github`, `gitlab`, `bitbucket`, or `azure`) to the pull request tools. Local review isn't available.
* **Other clients:** ask the agent to run `codeant_review_local`. If it returns `Could not find a .git directory`, the client starts the server outside your repository. Pass `name` and `remote` to the pull request tools, and run `codeant review` in a terminal for local review.
* **Azure DevOps:** always pass `name` as `project/repo`. Detection from Azure DevOps remote URLs doesn't produce that form.

## Self-hosted CodeAnt AI

Set both URLs in the server's environment, or save them once with the CLI:

| Setting | Environment variable | CLI command |
| - | - | - |
| API base URL | `CODEANT_API_URL` | `codeant set-base-url <url>` |
| Dashboard URL | `CODEANT_DASHBOARD_URL` | `codeant set-dashboard-url <url>` |

In the Claude Desktop extension, set **API base URL** and **Dashboard URL** in the extension settings instead. The extension's settings take precedence over values saved with the CLI.

The CLI asks your instance for its dashboard URL. If `codeant_login` fails with `Could not determine the dashboard URL`, set it explicitly. For self-hosted Git providers, see [Pull request tools](#pull-request-tools).

## Enable write tools

Set `CODEANT_READ_ONLY=0` only when the MCP client should be allowed to change external state. Add it to the `env` object of the `codeant` entry:

```json theme={"system"}
"env": {
  "CODEANT_READ_ONLY": "0"
}
```

In Claude Code, replace the server:

```bash theme={"system"}
claude mcp remove --scope user codeant
claude mcp add --scope user -e CODEANT_READ_ONLY=0 --transport stdio codeant -- codeant mcp
```

In the desktop extension, turn off **Read-only mode**. The Claude Code plugin is always read-only.

This adds three tools:

| Tool | Action |
| - | - |
| `codeant_scans_start` | Trigger a repository scan. |
| `codeant_pr_resolve` | Resolve a pull request conversation. |
| `codeant_api_request` | Call an authenticated POST, PUT, PATCH, or DELETE endpoint. |

<Warning>
  `codeant_api_request` can change or delete data in your CodeAnt AI organization. Enable write tools only when your agent needs them, keep your client prompting before each write call, and don't add write tools to auto-approve rules. Don't run `codeant_scans_start` in parallel with other tool calls.
</Warning>

## Approve tools automatically

Every read tool is marked read-only (`readOnlyHint`), so clients can approve it without prompting. `codeant_login` and `codeant_logout` aren't, so clients still ask before signing in or out.

In Claude Code, add rules to `permissions.allow` in `~/.claude/settings.json` (all projects) or `.claude/settings.json` (one project):

```json theme={"system"}
{
  "permissions": {
    "allow": [
      "mcp__codeant__codeant_scans_orgs",
      "mcp__codeant__codeant_scans_repos",
      "mcp__codeant__codeant_scans_results",
      "mcp__codeant__codeant_hotlist_list"
    ]
  }
}
```

With the Claude Code plugin, tool names start with `mcp__plugin_codeant_codeant__` instead of `mcp__codeant__`.

<Warning>
  The rule `mcp__codeant` approves every tool from the server, including write tools if you enable them later. List read tools individually instead.
</Warning>

## Results and paging

MCP clients limit how much tool output they accept. Claude Code, for example, caps it at 25,000 tokens by default. The server keeps results small:

* **One page per call.** Most list tools return a total and take `limit` and `offset`, but some differ: the Hotlist uses `cursor` and `next_cursor`, `codeant_pr_list` returns no total, and `codeant_scans_history` takes no `offset`. See each tool in the [MCP tool reference](/cli/mcp-tools) for its paging fields.

* **Small default page sizes:**

  | Tool | Default page size |
  | - | - |
  | `codeant_scans_repos` | 100 repositories |
  | `codeant_scans_results` | 50 findings |
  | `codeant_hotlist_list` | 10 findings |
  | `codeant_findings_antipatterns` | 25 findings |
  | `codeant_cloud_findings_list` | 25 findings |
  | `codeant_cloud_scan_history` | 10 newest scans per provider |
  | `codeant_pentest_history` | 25 newest engagements |

* **Slim records.** Repository lists, cloud scan history, cloud findings, and pentest history leave out bulky fields such as raw provider metadata, per-service rollups, compliance mappings, and billing details. Pass `full: true` to include them.

* **Size limit.** The server refuses any result over 80,000 characters (about 20,000 tokens) and returns a hint for narrowing the request. If your client accepts larger results, raise `CODEANT_MCP_MAX_RESULT_CHARS` in the server's environment. In Claude Code, also start Claude Code with a higher `MAX_MCP_OUTPUT_TOKENS`, for example `MAX_MCP_OUTPUT_TOKENS=50000 claude`. The desktop extension doesn't have a setting for the limit.

The CLI commands still return complete results.

## Privacy and telemetry

* Tools send requests to the CodeAnt API with your token. The pull request tools call your Git provider directly.
* `codeant_review_local` sends the diff and the full current contents of each changed file to CodeAnt for review. While reviewing, CodeAnt can also read, list, and search other files in the repository for context. The tool never modifies files.
* Local reviews send usage events to PostHog. The events are tied to your CodeAnt API token and can include review error messages. To turn them off, set `CODEANT_TELEMETRY_DISABLED=1` in the server's environment, run `codeant set-telemetry false` (not in the desktop extension), or enable **Disable telemetry** in the desktop extension.

See the [CodeAnt AI privacy policy](https://www.codeant.ai/privacy-policy).

## Troubleshooting

| Problem | Resolution |
| - | - |
| `codeant: command not found`, `env: node: No such file or directory`, or the server never starts | Use absolute paths in the client configuration, as described in the tip under [Install](#install), then restart the client. |
| Claude Desktop shows the server as failed | Read the server log: `~/Library/Logs/Claude/mcp-server-codeant.log` on macOS, `%APPDATA%\Claude\logs\mcp-server-codeant.log` on Windows. |
| Every tool returns `Missing API key` | Ask the agent to sign in with `codeant_login`, or run `codeant login` in a terminal. |
| Every tool returns `Invalid API key` or `Access denied (403)` | Ask the agent to sign in with `codeant_login` and `force: true`, or run `codeant logout` and then `codeant login`. If `CODEANT_API_TOKEN` is set in the client configuration, update or remove it. |
| `codeant_login` fails with `Could not determine the dashboard URL` | Set `CODEANT_DASHBOARD_URL` or run `codeant set-dashboard-url <url>`. See [Self-hosted CodeAnt AI](#self-hosted-codeant-ai). |
| A tool reports multiple matching organizations | Call `codeant_scans_orgs`, then pass both `org` and `service`. |
| A tool returns `Result too large` | Follow the hint: use a smaller `limit`, add filters, or project `fields`. Raise `CODEANT_MCP_MAX_RESULT_CHARS` only if your client accepts larger results. |
| `GitHub token not found` (or GitLab, Bitbucket, Azure DevOps) | Add the provider token to the server's `env` object, or run `codeant set-token <provider> <token>`. |
| `Azure DevOps org URL not found` | Set `AZURE_DEVOPS_ORG_URL`, for example `https://dev.azure.com/my-org`. |
| `Could not detect remote` | The server isn't running inside your repository. Pass `name` and `remote`. |
| `codeant_review_local` returns `Could not find a .git directory` | The client started the server outside a git repository. Use Claude Code, or run `codeant review` in a terminal. |
| Every CodeAnt tool appears twice | Remove one of the two configurations: the desktop extension or the `claude_desktop_config.json` entry, or the Claude Code plugin or the `claude mcp add` server. |
| A write tool is missing | Set `CODEANT_READ_ONLY=0` and restart the client. The Claude Code plugin is always read-only. |
| Self-hosted API isn't used | Set `CODEANT_API_URL` in the server's environment, or run `codeant set-base-url <url>`. In the desktop extension, set **API base URL**. |

To test the server outside your client, open it in the MCP Inspector:

```bash theme={"system"}
npx @modelcontextprotocol/inspector codeant mcp
```

The Inspector opens in your browser. Click **Connect**, then **List Tools**. You should see 24 tools, or 27 with write tools enabled.

<CardGroup cols={2}>
  <Card title="MCP tool reference" icon="list" href="/cli/mcp-tools">
    Parameters, defaults, and key response fields for every tool.
  </Card>

  <Card title="Findings" icon="shield-check" href="/cli/findings">
    Query repository, Hotlist, cloud-security, and pentest findings from the CLI.
  </Card>

  <Card title="SCM and PR tools" icon="code-pull-request" href="/cli/scm-integration">
    Manage pull requests, comments, and review data.
  </Card>

  <Card title="Claude Code integration" icon="message-bot" href="/cli/claude-code-integration">
    Slash-command skills that review and fix code with the CodeAnt CLI.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.