Connect AI agents to your Parascope CMDB over the Model Context Protocol — a read-only, per-tenant surface for infrastructure context.

Parascope hosts a Model Context Protocol (MCP) server for every tenant. It gives an AI agent one read-only surface for infrastructure context: what exists, how it connects, what changed, and what it looked like in the past. An agent that would otherwise trust stale documentation, or hold read credentials for every platform it might check, can point at Parascope instead.

The tool surface is read-only. There are no write or mutate tools. An agent can ask questions about your estate; it cannot change anything through Parascope.

Endpoint

Your MCP server lives at:

https://your-company.parascope.io/mcp

Replace your-company with your tenant subdomain — the same one you use for the Parascope UI. The server speaks the MCP Streamable HTTP transport, so any MCP-compatible client can connect to it remotely.

Authentication

The server uses OAuth 2.1. When a client first connects, it opens a browser and you sign in with your tenant's SSO, the same login you use for the Parascope UI. The client registers itself automatically (dynamic client registration), so there is no client ID or secret to configure and no API key to paste. Once you have signed in, the client stores the token and reconnects without prompting until it expires.

Because access is gated by your tenant's identity provider, only people who can already sign in to your Parascope can connect an agent to it.

What MCP access grants

Be deliberate about who you let sign in. Anyone who can sign in to your Parascope realm can connect an agent, and every agent gets the read access of your tenant's service key. The boundary is your tenant, not the individual user.

This includes data scopes. MCP tool calls run under the tenant service key, which data scopes do not apply to, so a user who only sees part of the estate in the web UI can read the whole estate through MCP. Because of that, MCP will not enable for a tenant that has a restrictive data scope in place; the guardrail keeps scoped data from leaking through the shared key. Per-user authorization is planned; for now, treat MCP as tenant-wide read access.

Connecting a client

The details below cover the two Anthropic clients. Any MCP client that supports remote servers over Streamable HTTP with OAuth will work the same way — point it at the endpoint above and complete the browser sign-in.

Claude Code

Add the server over the HTTP transport, then authenticate:

claude mcp add --transport http parascope https://your-company.parascope.io/mcp

Run /mcp inside Claude Code and choose Authenticate for the parascope server. Your browser opens for the SSO sign-in; once it completes, the tools are available in the session. Add --scope user to make the server available across all your projects, or --scope project to share the configuration with your team through a checked-in .mcp.json.

Claude Desktop

Open Settings → Connectors → Add custom connector, give it a name (for example, Parascope), and paste the endpoint URL. Claude Desktop handles the OAuth sign-in from the connector dialog. You do not need the mcp-remote bridge — that older claude_desktop_config.json workaround is only for clients that cannot connect to a remote OAuth server directly.

Other MCP clients

For any other client, add a remote MCP server with:

Transport: Streamable HTTP
URL: https://your-company.parascope.io/mcp
Auth: OAuth 2.1 (the client discovers the flow from the endpoint; no manual credentials)

Tools

The server exposes twelve read-only tools, grouped below by what they answer.

Discovery

Tool	What it does
`search_cis`	Search configuration items by name, type, source, status, or full-text query.
`get_ci`	Retrieve a single configuration item by UUID or exact name.
`list_ci_types`	List the CI types known to the CMDB, optionally filtered by source.

Change history and time travel

Tool	What it does
`get_changes`	Retrieve the change history for a CI, or the global change feed, with before-and-after state.
`get_ci_at`	Fetch the state of a CI at a point in time. Covers the past 365 days.

Relationships and impact

Tool	What it does
`get_relationships`	Get the incoming and outgoing relationship edges for a CI.
`get_lineage`	Traverse the full dependency lineage of a CI, from application tier down to hardware.
`get_impact`	Assess the blast radius and downstream impact of a CI.
`get_criticality`	Return the criticality score and tier for a CI.

Querying

Tool	What it does
`execute_paraql`	Run a ParaQL query against the CMDB, including `AS OF` and staleness functions.
`natural_language_query`	Translate a plain-English question into ParaQL and run it.

Sources

Tool	What it does
`list_sources`	List the configured data sources and their collection status.

Resources

The server also publishes MCP resources an agent can read for orientation before it starts querying:

Resource	Contents
`parascope://ci-types`	All CI types tracked by Parascope, grouped by source with counts.
`parascope://ci-types/{source}`	CI types for a specific source (for example, `kubernetes`, `aws`, `proxmox`).
`parascope://sources`	Configured data sources and their collection health.

Prompts

Three guided prompts package common workflows so an agent (or a person driving it) can start from a task rather than a raw tool call:

Prompt	Purpose
`investigate_incident`	Investigate an incident by checking recent changes, dependencies, and blast radius for a CI.
`map_dependencies`	Map what a CI depends on and what depends on it.
`explore_infrastructure`	Explore what Parascope knows about — a starting point for new users.

Freshness and time-travel answers

Every answer reflects what Parascope last observed, which is as current as the most recent collection cycle. ParaQL exposes staleness functions (stale_for(), IS STALE BY), so an agent can check how fresh its own context is before acting on it. Point-in-time queries (get_ci_at, and AS OF in ParaQL) reach back over the past 365 days, so an agent can ask what a system looked like before an incident or a change.

REST alternative

If you would rather call the API directly than use MCP, a single read-only API key (ps_ro_) covers the same ground over HTTP: search, changes, relationships, impact, and ParaQL. See API Tokens and Keys and the API Reference.

ParaQL Query Language — the query language behind execute_paraql
Natural Language Queries — how plain-English questions become ParaQL
Infrastructure Lineage — the dependency graph get_lineage walks
Authentication — SSO and API token authentication
API Tokens and Keys — read-only keys for the REST alternative

MCP Server