MCP Server

MCP (Model Context Protocol) is an open standard that lets an AI client call tools on a remote server. Cloaking X exposes one at https://cloakingx.com/api/mcp, scoped to a single account by the key you connect with. Once connected, you ask questions in plain language instead of opening the dashboard or writing API calls:

• “What’s my block rate today, and which stream is worst?”
• “Show me the last 20 blocked clicks on my main stream and tell me what they have in common.”
• “Which detection blocked the most traffic this week?”
• “Add 203.0.113.0/24 to the blacklist and note it as a scraper range.”

The client decides which tools to call and chains them itself — asking about one stream’s block reasons typically means it calls list_streams first to resolve the id, then summarize_block_reasons.

Open MCP in the dashboard sidebar and create a key. Give it a label naming the client it is for (“Claude Code — laptop”), so you can revoke exactly that one later, and pick a scope:

• Read only — the six read tools. The client can inspect everything and change nothing.
• Read + Write — adds the four blacklist/whitelist write tools.

Claude Code#

claude mcp add --transport http cloaking-x https://cloakingx.com/api/mcp \
  --header "Authorization: Bearer YOUR_MCP_KEY"

Claude Desktop, Cursor, and other JSON-configured clients#

Add the server to your client’s MCP configuration file:

{
  "mcpServers": {
    "cloaking-x": {
      "type": "http",
      "url": "https://cloakingx.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_MCP_KEY"
      }
    }
  }
}

Any HTTP client#

The endpoint is plain JSON-RPC 2.0 over POST, so you can talk to it with curl. List the tools your key can reach:

curl -X POST https://cloakingx.com/api/mcp \
  -H "Authorization: Bearer YOUR_MCP_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

And call one:

curl -X POST https://cloakingx.com/api/mcp \
  -H "Authorization: Bearer YOUR_MCP_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 2,
    "method": "tools/call",
    "params": {
      "name": "summarize_block_reasons",
      "arguments": { "from": "2026-08-01", "to": "2026-08-02" }
    }
  }'

Read tools any key#

Write tools read_write keys only#

Date arguments (from, to) are ISO dates and the window is inclusive. Where streamId is optional, omitting it returns account-wide figures.

Scopes & Permissions#

A read key never sees the write tools at all — they are filtered out of tools/list, so the client cannot attempt a change and be refused; it simply has no such capability. This matters in practice: an agent that cannot see a destructive tool will not reach for it.

Two limits apply on top of the scope. Every tool is bound to the account the key belongs to, so a key can never read or touch another account’s data. And if you are a team member rather than the account owner, your own role still applies — a read-only member holding a read_write key is refused on write calls. The key can never grant more than the person holding it already has.

• Endpoint — POST https://cloakingx.com/api/mcp
• Transport — HTTP, JSON-RPC 2.0
• Protocol version — 2024-11-05
• Server identity — cloaking-x v1.0.0
• Methods — initialize, tools/list, tools/call, and the notifications/initialized notification
• Auth — Authorization: Bearer <key>. A ?token= query parameter is accepted only as a fallback, for clients that cannot set headers — prefer the header, since URLs end up in logs and browser history.

The client connects but every call returns 401#

The key is missing, mistyped, or has been deleted. Check the header is literally Authorization: Bearer <key> — the word Bearer and a single space are both required. A key pasted with a trailing newline is a common cause.

Only six tools appear#

That is a read key working correctly. Write tools are hidden from read keys by design. Create a Read + Write key and reconnect — clients cache the tool list from initialize, so a restart is usually needed.

A write call is refused even with a read_write key#

You are signed in as a team member whose role is read-only. The key cannot exceed your own permissions — ask the account owner to change your role, or use a key created under an account with write access.

Tools return empty results#

Check the date window first: from/to are inclusive ISO dates, and a window before the stream existed returns nothing. If list_streams itself is empty, the key belongs to an account with no streams — likely not the account you meant.