Model Context Protocol

Remote MCP

Remote MCP allows you to connect to RunReveal’s hosted MCP server over HTTP/HTTPS. This enables you to:

• Access your RunReveal data and tools from any AI assistant that supports MCP
• Share MCP servers across multiple team members
• Run MCP servers in production environments
• Centralize data access and permissions
• Use OAuth authentication for seamless setup

Setting Up with Claude

Prerequisites:

• A RunReveal account with API access
• Claude Desktop or Claude.ai account

Step 1: Add the Integration

1. In Claude, go to Add integration (BETA)
2. Enter the following details:
   • Integration Name: RunReveal
   • Server URL: https://api.runreveal.com/mcp

Step 2: Trust the Integration

Claude will show a warning that this integration has not been verified by Anthropic. Click Add to proceed.

Step 3: Authorize with RunReveal

1. You’ll be redirected to RunReveal’s authorization page
2. Review the OAuth client information:
   • Client Name: claudeai
   • Client ID: (will be displayed)
3. Select your workspace from the dropdown
4. Click Continue to authorize the connection

Alternative: Using Claude Code CLI

If you’re using Claude Code (the CLI tool), you can add the RunReveal MCP server directly from the command line:

claude mcp add -t http runreveal 'https://api.runreveal.com/mcp'

This command will:

• Add the RunReveal MCP server to your Claude Code configuration
• Use the identifier “runreveal” for the server

After running this command, the MCP server will be available in your Claude Code sessions, and you’ll go through the same OAuth authorization flow when first accessing RunReveal tools.

Step 4: Verify the Connection

Once authorized, you should see RunReveal listed in your Claude integrations with available tools:

The RunReveal MCP integration provides access to several tools:

• detections_list - List all detection rules
• detections_get - Get details for a specific detection
• run_query - Execute SQL queries against your data
• list_tables - View available data tables
• get_table_schema - Get schema information for tables
• detections_create - Create new detection rules
• source_list - List available data sources

Setting Up with Cursor

Prerequisites:

• A RunReveal account with API access
• Cursor IDE installed

Configuration:

Click this link:

Or, manually add this to your configuration:

{
  "mcpServers": {
    "RunReveal": {
      "url": "https://api.runreveal.com/mcp"
    }
  }
}

Authentication Flow:

Similar to Claude, Cursor will redirect you to RunReveal’s OAuth authorization page where you can:

1. Select your workspace
2. Grant the necessary permissions (OAuth scopes)
3. Complete the OAuth flow

The MCP endpoint requires an Authorization header with a Bearer token. OAuth tokens are workspace-specific and use scopes that determine your permissions for the available tools.

Troubleshooting

Connection Issues:

• Verify your RunReveal API credentials are valid
• Check that you have the necessary permissions in your workspace
• Ensure the MCP server URL is correct: https://api.runreveal.com/mcp

Authentication Problems:

• Clear your browser cookies and retry the OAuth flow
• Make sure you’re selecting the correct workspace during authorization
• Contact RunReveal support if you continue having issues

Security Considerations:

• The MCP connection uses OAuth for secure authentication
• Tools respect your existing RunReveal permissions and access controls
• All data transmission is encrypted over HTTPS
• You can revoke access at any time through your RunReveal workspace settings

Local MCP

Local MCP runs the RunReveal MCP server as a local process, ideal for:

• On-premises RunReveal deployments
• Custom API endpoints
• API token-based authentication

Prerequisites

• RunReveal CLI installed (brew install runreveal)
• API token with appropriate permissions
• Workspace ID
• Custom base URL (for on-premises deployments)

Environment Variables

Set the following environment variables for your local MCP server:

export RUNREVEAL_TOKEN="your-api-token-here"
export RUNREVEAL_WORKSPACE="your-workspace-id-here"
export RUNREVEAL_BASEURL="https://api.runreveal.com"  # or your on-prem URL

For on-premises deployments:

export RUNREVEAL_BASEURL="https://api.YOUR_BASE_DOMAIN.runreveal.com"

Getting Your API Token:

Copy your API token directly from the RunReveal UI:

1. Go to your RunReveal workspace
2. Navigate to Settings → API Tokens
3. Copy the token value (it will be in the format that works with the local MCP server)
4. Use this token value in your RUNREVEAL_TOKEN environment variable

Setting Up with Claude and Cursor

Add this configuration to your Claude or Cursor MCP settings:

{
  "mcpServers": {
    "runreveal": {
      "command": "runreveal",
      "args": ["mcp"],
      "env": {
        "RUNREVEAL_TOKEN": "your-api-token-here",
        "RUNREVEAL_WORKSPACE": "your-workspace-id-here",
        "RUNREVEAL_BASEURL": "https://api.runreveal.com"
      }
    }
  }
}

The configuration is identical for both Claude and Cursor when using local MCP.

Authentication Differences

Local MCP (API Token):

• Requires explicit API token setup
• No OAuth flow needed
• Works with on-premises deployments
• Token must have appropriate permissions

Troubleshooting

Connection Issues:

• Verify your API token is valid and has appropriate permissions
• Check that RUNREVEAL_WORKSPACE is set to the correct workspace ID
• Ensure RUNREVEAL_BASEURL points to the correct API endpoint
• Test your CLI connection: runreveal workspaces list

Authentication Problems:

• Verify your API token hasn’t expired
• Check that the token has the necessary permissions for MCP tools
• Ensure environment variables are properly set in your MCP configuration
• Test token authentication: runreveal logs query "SELECT 1 LIMIT 1"

Security Considerations:

• API tokens provide secure authentication without OAuth flow
• Tokens can be scoped to specific permissions and workspaces
• All data transmission is encrypted over HTTPS
• You can revoke or rotate API tokens through your RunReveal workspace settings
• Environment variables should be kept secure and not shared