MCP integration

Patronus can protect a local client’s MCP access or expose scans as remote MCP tools.

Protect local MCP use

The desktop app discovers supported MCP configurations. Review the server in local assets and choose Monitor when available. For stdio servers, a local Patronus gateway sits between the client and the server. HTTP-based servers depend on the configured route.

Confirm the server reaches Monitored, then test a harmless tool call and inspect its trace. Monitor pending or a discovered configuration alone does not prove that calls pass through protection.

Follow Agents, skills, and MCP for review and drift handling. Monitoring a local server does not require publishing that server on the internet.

Call Patronus scan tools remotely

The Control Plane exposes remote MCP at:

https://control.patronus.studio/api/mcp

Its scan tools use the same operations and limits as the HTTP API:

Tool	Use
submit_scan	Submit text or TXT, Markdown, HTML, PDF, and DOCX using the shared API
get_scan	Retrieve a submitted job using a key from the same account
scan_text	Run a limited demo scan of up to 1,000 Unicode characters
scan_file	Scan one supported document, subject to the account plan’s file limit
scan_url	Scan the supported static content of a public HTTPS page
scan_server	Scan a public remote MCP server’s metadata without executing tools

Files use Base64 and must fit the 12 MB MCP request envelope. Extracted canonical content allows 100,000 bytes for Free and Personal or 1,000,000 bytes for Pro. Free and Personal also allow at most 25,000 tokens per submission. Authenticated API and MCP calls share Scan Units, token balance, and rate limits.

The anonymous scan_text demo has separate abuse limits and does not charge account units.

Add the server URL to a compatible MCP client. The client discovers Patronus OAuth metadata, opens the Control Plane for sign-in and consent, and receives a 14-day bearer through Authorization Code + PKCE. Revoke it under API Keys. Each tool retains its API endpoint’s authorization and limits.

See the API Reference for authenticated inputs, results, and account requirements. Clients without MCP OAuth can use a manually created Control Plane API key as a Bearer credential; never place it in a URL.

Choose the right path

Use local MCP protection to observe and govern a supported client’s tool use. Use remote scan tools when you explicitly want an agent to submit content for a Patronus assessment. Remote scans do not automatically intercept the agent’s other tool calls.