Quickstarts

MCP quickstart

Mask the arguments and results of MCP tool calls by registering the MCP server in Maskflare and pointing your agent at the gateway.

Agents send data to MCP servers in tool-call arguments and get data back in results. Maskflare sits between the agent and a registered MCP server: tool arguments are masked before the server sees them, results are masked on the way back, and a block rule's match stops the call.

1. Register the MCP server

In the console open MCP servers, choose the environment and add the server's name and Streamable HTTP URL. The server must be reachable on a public address.

2. Point the agent at the gateway

Use https://YOUR_GATEWAY_HOST/v1/mcp/<name> as the server URL and send a Gateway key as X-Maskflare-Key (or as a Bearer token). Any other Authorization: Bearer is the MCP server's own credential and is passed on to it.

Claude Code

claude mcp add --transport http crm https://YOUR_GATEWAY_HOST/v1/mcp/crm \
  --header "X-Maskflare-Key: mf_live_..." \
  --header "Authorization: Bearer <the CRM server's own token>"

Calls show under Traffic with provider mcp and the server's name as the model. An unknown name is `unknown_mcp_server`.

Manage Maskflare from an assistant

A different use of MCP: uvx maskflare-mcp runs Maskflare's admin MCP server, which reads your organization (devices, traffic, rules, audit trail) through the platform API as an API client, read-only unless you enable write tools.