Documentation

Inth MCP

Inth MCP gives an MCP client the same reach as the REST API: organizations, members and invitations, projects and their consent settings, API keys, Code Audit scans, the Inbox, and the credit balance. Each tool needs the scope you approve at sign-in.

The server URL is https://api.inth.com/mcp.

Add Inth MCP

Codex

codex mcp add inth --url https://api.inth.com/mcp

MCP servers and skills are separate in Codex. Restart any running Codex sessions after adding the server, then open the MCP server list to sign in.

Claude Code

claude mcp add --transport http inth https://api.inth.com/mcp

Add to several clients

This installer can add Inth MCP to several supported clients:

npx -y add-mcp https://api.inth.com/mcp -g

It prints the configuration files it changed. If a client does not list Inth after the command finishes, use its direct command above or add the server URL manually.

Other MCP clients

Add a remote MCP server with this configuration:

{
	"mcpServers": {
		"inth": {
			"url": "https://api.inth.com/mcp"
		}
	}
}

Your client opens Inth in a browser the first time it connects. Sign in and approve access. You do not need an API key.

Available tools

The tools mirror the REST API one for one and return the same resource shapes.

Tool	What it does	Changes data
`list_organizations`	Lists organizations you belong to	No
`get_organization`	Gets one organization	No
`create_organization`	Creates an organization owned by you	Yes
`list_members`	Lists the members of an organization	No
`update_member`	Changes a member's role	Yes
`remove_member`	Removes a member	Yes
`list_invitations`	Lists pending invitations	No
`invite_member`	Emails an invitation to join an organization	Yes
`cancel_invitation`	Cancels a pending invitation	Yes
`list_regions`	Lists regions available for new projects	No
`list_projects`	Lists projects you can access, with consent settings	No
`get_project`	Gets one project	No
`create_project`	Creates a project and its consent runtime	Yes
`update_project`	Renames a project or changes its consent settings	Yes
`delete_project`	Archives a project	Yes
`list_api_keys`	Lists organization API keys	No
`create_api_key`	Creates an organization API key	Yes
`roll_api_key`	Replaces the secret of an API key	Yes
`delete_api_key`	Revokes an API key	Yes
`get_billing`	Plan, credit balance, and automatic top-up settings	No
`list_code_audit_repositories`	Connected GitHub repositories	No
`list_code_audit_scans`	Scans with status, counts, and lock state	No
`get_code_audit_scan`	One scan	No
`get_code_audit_scan_request`	Status of a pending scan request	No
`start_code_audit_scan`	Starts a scan of a repository's production branch	Yes
`get_code_audit_scan_issues`	The findings of a scan	No
`unlock_code_audit_scan`	Spends credits to unlock a free preview	Yes
`list_inbox_items`	Findings in the Inbox	No
`get_inbox_item`	One finding with its code evidence	No
`update_inbox_item`	Sets a finding to open, accepted, dismissed, or resolved	Yes
`create_inbox_github_issue`	Opens a GitHub issue for a finding	Yes

Every tool is annotated so clients can tell read-only tools from destructive ones and ask for confirmation before the latter.

See MCP tools for arguments and example prompts.

Access

Inth MCP uses the scopes approved during sign-in and your current organization memberships. Read tools need the matching .read scope and any member can use them, except list_invitations and list_api_keys, which need an admin or owner role. Write tools need the matching .write scope and an admin or owner role in the organization, except create_organization, which lets you create your first organization without an existing membership. Only owners can grant the owner role, invite owners, or unlock a Code Audit report. list_regions needs no scope. Starting a scan and unlocking a report spend organization credits, so a client should show the cost from get_code_audit_scan_issues and ask before calling them. A tool called without its scope returns a tool error with code INSUFFICIENT_SCOPE; the HTTP response itself still succeeds, as with any MCP tool result.

Review any proposed write before approving it. If someone loses access to an organization, the change applies to their next tool call.

Reauthorize older connections

mcp:tools still allows access to the MCP transport. Each organization action also requires its matching resource scope, such as projects.read or code-audit.read. The protocol scope alone only allows listing public regions.

Older connections granted only mcp:tools must sign in again and approve the resource scopes. They receive INSUFFICIENT_SCOPE until then. Refreshing an old token does not add permissions, and registering a new client is unnecessary. This launch deliberately removes the old implicit capability grant.

Troubleshooting

Remove the saved Inth connection from your client, add it again, then retry the first tool call. Check that the server URL is exactly https://api.inth.com/mcp.

The client returns `401 Unauthorized`

Reconnect Inth from the client so it can start a new sign-in flow. Do not use an organization API key as the MCP credential.

An organization or project is missing

Sign in to Inth with the same account and check that it belongs to the expected organization. MCP results follow that account's current access.

Project creation is denied

Ask an organization admin or owner to create the project. The organization must also have API access.