MCP

MCP Server

The Columbo MCP server allows MCP-compatible assistants to retrieve Columbo data through the API. The server provides read-only access to accounts, Audits, Scenarios, Tests, Schedules, and their results.

The production server is available over Streamable HTTP at https://api.columbo.io/mcp.

Production HTTP connection

Regular Columbo users connect through their MCP client's remote server configuration. No Columbo checkout, Node.js installation, or npm command is required.

Use this endpoint:

https://api.columbo.io/mcp

The endpoint uses the same BasicAuth credentials as the Columbo API:

Authorization: Basic <base64(email:apiPassword)>

Requests must also declare both content types the MCP transport can answer with:

Accept: application/json, text/event-stream

MCP client libraries send this header automatically. A request without it is rejected with status 406.

The API password is different from the password used to log in to Columbo. It changes whenever the regular password changes. Keep it in the MCP client's secret configuration.

The API authenticates the user before the MCP route runs, and every tool call is then authorized like the equivalent API request. An assistant therefore sees exactly the accounts and resources its user may read, including the restrictions that apply to guest users.

Available data

The server exposes tools for the following data:

• Accounts: list and retrieve accounts
• Audits: retrieve Audits with their result summary, captured Pages, Checks, Scenarios, and sweeps
• Scenarios: list and retrieve Scenarios and Scenario Runs
• Tests: list and retrieve Tests
• Schedules: list and retrieve Schedules, and list their runs
• Parameters and Variables: list and retrieve both, and where each one is used
• Change history: the recorded configuration changes of an Audit, Scenario, Test, Schedule, or Variable

A typical request starts with list_accounts when the account ID is unknown. The assistant can then use the account ID to retrieve the Audits, Scenarios, Tests, or Schedules belonging to that account.

Investigating a result

Several tools answer a whole question in one call, which keeps an assistant from paging through large amounts of data to get there:

• get_audit_overview returns an Audit together with its result summary, configured Tests, attached Scenarios, running sweep, and evaluated Checks
• list_audit_page_errors returns the Pages that failed to load, with the status code and error that explain why
• list_audit_pages_failing_test and list_audit_pages_failing_check return the Pages where one Test or one Check failed
• get_scenario_run_predecessor returns the Scenario Run before a given one, so the two can be compared

Read-only access and redaction

Only read operations are available. The MCP server cannot create, edit, delete, start, pause, or rescan Columbo data.

Credentials that Columbo stores in order to do its work are removed before any data is sent to the assistant:

• API keys, API passwords, passwords, access and refresh tokens, and client secrets, including the password of an Audit's or Scenario's HTTP authentication
• the value of every cookie and local storage entry, on Audits, on Scenarios, and on captured Pages. The name, domain, and flags are kept so a Page can still be examined
• the value a Scenario step types into a form field, which is how a login Scenario carries its password

Everything else an Audit records, including page content details such as titles, metatags, and detected tools, is returned as it is stored. If an audited site exposes sensitive data in a place Columbo captures, that data can reach the assistant.