MCP access

​

Where it lives

In Clarion, go to Settings > MCP access. The page has two tabs:

• API tokens — mint, list, and revoke long-lived bearer tokens. One row per token; the plaintext is shown exactly once at creation time.
• OAuth setup — copy-paste snippets for Claude Code and Claude Desktop, plus a generic note for other MCP clients. No secrets to manage.

The MCP endpoint itself is at https://<your-clarion-host>/api/mcp (the OAuth setup tab fills in the right URL for your environment).

---

​

Choosing a flow

If a client supports OAuth, use it. The browser flow handles re-auth automatically when access expires; long-lived tokens never rotate and stay valid until revoked.

---

​

Connecting via OAuth

​

Claude Code (CLI)

1. Open Settings > MCP access > OAuth setup and copy the claude mcp add command shown there. It already contains the right URL for your workspace.
2. Run it:
   claude mcp add --transport http clarion https://<your-clarion-host>/api/mcp
   
3. Start a session. On the first tool call Claude Code opens the Clarion OAuth grant page — pick the workspace and approve. The token is captured by Claude Code’s local callback.

​

Claude Desktop

1. Open Settings > MCP access > OAuth setup and copy the JSON snippet.
2. Paste it into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or the equivalent path on Windows/Linux:
   {
     "mcpServers": {
       "clarion": {
         "type": "http",
         "url": "https://<your-clarion-host>/api/mcp"
       }
     }
   }
   
3. Restart Claude Desktop. The first tool call triggers the same browser grant flow as the CLI.

​

Other MCP clients

Point any MCP client that speaks the Streamable HTTP transport at https://<your-clarion-host>/api/mcp. The first unauthenticated request returns a WWW-Authenticate challenge that points at /.well-known/oauth-protected-resource; any spec-compliant client follows the metadata to discover the authorization server and complete the OAuth flow without extra config.

---

​

Connecting via a long-lived API token

Use this when the client can’t drive an interactive browser sign-in.

1. In Settings > MCP access > API tokens, click New token.
2. Give it a label that lets you recognize it later (e.g. CI nightly drift check, Cron worker).
3. Click Create token. The dialog swaps to a one-time reveal — copy the plaintext now. Once you close the dialog the secret is gone for good.
4. Paste the token into your MCP client config as a Bearer credential:
   {
     "mcpServers": {
       "clarion": {
         "type": "http",
         "url": "https://<your-clarion-host>/api/mcp",
         "headers": { "Authorization": "Bearer <PASTE_TOKEN_HERE>" }
       }
     }
   }
   

​

Revoking a token

In the API tokens tab, click the revoke icon on the row, confirm, and the token stops authenticating immediately. Any client still using it gets a 401 on its next request. Revocation is one-way; revoked rows stay in the list with a “Revoked” badge so you can audit who created them and when.

---

​

Available tools

After connecting, the client sees the following workspace-scoped tools under the clarion server (so each one appears as mcp__clarion__<tool>). Every tool is scoped to the token’s workspace: reads filter by workspace, cross-workspace lookups return an error rather than another tenant’s data, and mutations are attributed to the operator who minted the token.

​

Read & triage

Alerts

• list_alerts — paginated list, filterable by status / severity / search
• get_alert — full alert detail by display number
• complete_remediation_item — toggle a checklist item on an alert’s remediation list
• retrigger_alert — re-run triage agents for an alert (e.g. after deploying a fix)

Incidents

• list_incidents — paginated list with the same filters as alerts, plus search
• get_incident — incident detail including linked alerts

Tasks

• list_tasks — paginated list, filter by status / priority / alertNumber (useful for “has this alert been escalated yet?”)
• get_task — single task by id

Monitors & integrations

• list_monitors, get_monitor — the workspace’s ingestion sources, with sanitized per-type config (webhook secrets stripped)
• list_integrations, get_integration_health — integration sync health (consecutive failures, pause state, auth errors); credentials are never returned

Signals

• list_signals, get_signal — the raw ingested events that feed alerts, before any alert fires

Schedules

• list_schedules, get_schedule — discover what’s running in the workspace
• list_schedule_runs, get_schedule_run — poll-friendly run snapshots
• run_schedule_once — fire a schedule out-of-band without changing its cron cadence
• cancel_schedule_run — cancel a pending or running execution
• create_schedule, update_schedule, set_schedule_enabled, delete_schedule — full CRUD on recurring tasks

​

Configure the workspace

Agents

• list_agents, get_agent — the workspace’s triage agents and their linked skills/monitors
• create_agent, update_agent — manage an agent’s name, active state, linked skills, and linked existing monitors. Monitor creation stays in the Clarion UI — it involves webhook secrets and registration that aren’t exposed over MCP.

Skills

• list_skills, get_skill — reusable workspace skills, instructions returned as markdown
• create_skill, update_skill — author or edit a skill from markdown; tools are extracted from the inline <tool> pills, and edits snapshot a new version

Templates

• list_skill_templates, get_skill_template — browse the curated skill-template catalog
• create_skill_from_template — instantiate a skill template into a managed workspace skill (auto-updates when the template changes; idempotent — returns the existing copy if already instantiated)
• list_agent_templates, get_agent_template — browse the published agent-template catalog
• create_agent_from_template — scaffold an agent plus its managed skills from a template, created inactive so you can review before it runs

Workspace

• list_workspace_tools — the action tools currently available to agents in this workspace. Only tools whose backing integration (and any required credentials or pauser config) is actually connected are returned — unconfigured ones are omitted — so this reflects what a skill can reference today. Includes the workspace’s custom MCP servers, custom API/CLI toolsets, and Microsoft Sentinel tools.
• get_workspace_instructions, set_workspace_instructions — read or replace the default agent instructions (markdown) applied to every agent in the workspace