MCP Server

OAuth 2.1 (PKCE) · content-blind · in the official MCP registry

AtlasBurn ships a public Model Context Protocol server so any AI assistant — Claude, ChatGPT, Cursor, Codex — can answer questions from your real AtlasBurn data, and set AtlasBurn up in your project when you ask it to. Listed in the official registry as com.atlasburn/atlasburn. Endpoint: https://app.atlasburn.com/api/mcp.

What it does

Most AI cost tools make you open a dashboard. The MCP server lets you stay in your editor or chat and just ask: "what did we spend this week, and what's driving it?" or "have there been any guardrail breaches?" — and get answers pulled live from your telemetry. It never exposes prompts or model outputs, only aggregated economics and metadata.

It can also do the setup for you: say "Integrate AtlasBurn" in Claude Code (or any MCP client that can run commands) and it gets a key — after you approve it — and wires the SDK or Edge Proxy into your project. See Integrate AtlasBurn from Claude.

Tools

Tool	Returns	Type
`get_cost_summary`	Spend + token usage over a window (default 30 days)	Read-only
`get_cost_breakdown`	Attribution by model and by feature	Read-only
`get_runway_forecast`	Runway days, burn, reserves, systemic risk	Read-only
`get_guardrail_status`	Enabled/mode/status, features paused by a loop, budgets, recent breaches	Read-only
`get_runtime_signals`	Retry rate, loop probability, RPS, model mix	Read-only
`request_integration_key`	Starts “Integrate AtlasBurn”: a pending key request and the link you approve it at	Setup
`get_setup_code`	After you approve: a one-time setup code and the commands to run	Setup

The five read tools are annotated readOnlyHint: true. The two setup tools are annotated readOnlyHint: false, destructiveHint: false: the only thing they write is a pending request or a one-time code. No tool can change settings, budgets, or guardrails, revoke a key, or delete data.

Cost tools cover the full window you ask for (1–365 days): totals and breakdowns come from server-side daily summaries, not just the most recent requests. On an account that hasn't sent any data yet, every tool also returns a short setup guide instead of a page of zeros.

Integrate AtlasBurn from Claude

Open your project in Claude Code, connect the AtlasBurn server (below), and ask:

text

Integrate AtlasBurn into this app

Claude looks at your project, picks the SDK (Node.js / TypeScript) or the Edge Proxy (any language), and calls request_integration_key. You get an approval link: app.atlasburn.com/mcp/approve?r=…. Nothing is created yet.
Open the link. AtlasBurn asks you to sign in again (a sign-in from the last 5 minutes), checks it's the same account you connected to Claude, and shows exactly what will happen. Click Approve.
Claude calls get_setup_code and gets a one-time setup code (valid 10 minutes, single use) plus the commands to run:

SDK

bash

npm install @atlasburn/sdk
npx abn init --code abset_… --yes

Edge Proxy (any language)

bash

npx --yes --package @atlasburn/sdk abn init --code abset_… --proxy --yes

The CLI redeems the code, and only then is the key created. It goes straight into your project's env file (and is checked against .gitignore), then the CLI wires initialization and sends a verification event. For the proxy it writes the key and prints the base URL and header to use for each provider; Claude then updates your client code.

Why it's safe

The key never enters the chat. The assistant (Claude, Codex, Cursor…) only ever sees the setup code; the raw key is returned to the CLI on your machine and written to your env file.
A connected assistant can't mint keys on its own. Every key needs your approval in AtlasBurn, with a fresh sign-in, as the same person who connected it.
Additive only. A new key is added; existing keys keep working. Up to 5 active keys per account.
Visible and revocable. Keys created this way are labelled with the agent that asked, e.g. “via Claude Code” or “via Cursor”, in System Controls → Keys, where you can revoke them like any other key.
Short-lived. Requests expire after 10 minutes; setup codes after 10 minutes or one use. Both are stored only as salted hashes.

Connect it

The connection flow is the same across clients: point them at the endpoint, and they discover OAuth automatically and open the AtlasBurn consent screen.

Claude Code

bash

claude mcp add --transport http atlasburn https://app.atlasburn.com/api/mcp
# then in Claude Code: /mcp -> atlasburn -> Authenticate

Or commit a project-scoped .mcp.json so your whole team gets it:

.mcp.json

json

{
  "mcpServers": {
    "atlasburn": { "type": "http", "url": "https://app.atlasburn.com/api/mcp" }
  }
}

Claude (Desktop / claude.ai) & ChatGPT

Add a custom / remote connector with the URL below (AtlasBurn is also in the Claude connector directory). The client runs the OAuth flow, you sign in to AtlasBurn and approve access, and the tools appear in-chat.

HTTPS

http

https://app.atlasburn.com/api/mcp

MCP Inspector (to test)

bash

npx @modelcontextprotocol/inspector
# Transport: Streamable HTTP
# URL: https://app.atlasburn.com/api/mcp
# Connect -> sign in -> Authorize -> List Tools

The connection belongs to whichever AtlasBurn account you sign in with during OAuth. If your browser is signed in to a different account, sign out first. A key request can only be approved by that same account; any other account sees “This request belongs to a different AtlasBurn account”.

Authentication & security

OAuth 2.1 authorization-code flow with PKCE (S256 only); scoped token (atlasburn:read), short-lived access + rotating refresh. The token is accepted only by the MCP endpoint, nowhere else in AtlasBurn.
Tenant isolation — every call is scoped to the org resolved from the token, never from a tool argument.
Content-blind — only aggregated economics/metadata is exposed; never prompts or completions.
No direct writes — the token can read your data and open a key request, nothing else. Creating a key always takes your separate approval (above). Codes, requests, and tokens are stored as salted HMAC hashes; every tool call is audit-logged.
Rate-limited — at most 5 integration requests per hour per user.

Behind Cloudflare?

If your app domain sits behind Cloudflare, make sure Bot Fight Mode / "Block AI bots" is not challenging the connector paths — AI platforms call your server from datacenter IPs, and a bot rule will 403 the OAuth registration step.

Registry

AtlasBurn is published in the official MCP registry. Marketplaces that sync from it (Glama, mcp.so, PulseMCP) list it automatically.

bash

curl "https://registry.modelcontextprotocol.io/v0.1/servers?search=com.atlasburn/atlasburn"

Next Steps

Quickstart — set AtlasBurn up by hand or with the abn CLI
SDK Integration — send the telemetry the MCP tools read
5-Layer Defense Engine — what get_guardrail_status reflects
Security — the full trust model