Ocean MCP Server

The Ocean MCP server exposes the same data as the REST API through the Model Context Protocol, so AI agents and MCP-aware clients (Claude Code, Claude.ai, Cursor) can look up scanned users, risk scores, and cheater database records without writing REST calls by hand.

Endpoint: https://api.anticheat.ac/mcp

Transport: Streamable HTTP (POST only, JSON responses)

Authentication: OAuth 2.1 with PKCE

Connecting

The server speaks Streamable HTTP, so any MCP client that supports that transport can connect. Every client below handles the OAuth login itself — the first connection attempt opens your browser at Ocean's authorization page (https://api.anticheat.ac/oauth/authorize, which sends you to the consent screen), where you log in and pick which scopes to grant.

Claude Code

Add the server, then authenticate with /mcp inside Claude Code:

claude mcp add --transport http ocean https://api.anticheat.ac/mcp

Or add it to .mcp.json in your project:

{
  "mcpServers": {
    "ocean": {
      "type": "http",
      "url": "https://api.anticheat.ac/mcp"
    }
  }
}

Claude.ai / Claude Desktop

Settings → Connectors → Add custom connector. Name it Ocean, set the URL to https://api.anticheat.ac/mcp, then Connect and complete the Ocean login. No JSON configuration needed.

Cursor

Add to ~/.cursor/mcp.json (global) or .cursor/mcp.json (project):

{
  "mcpServers": {
    "ocean": {
      "url": "https://api.anticheat.ac/mcp"
    }
  }
}

Then in Cursor Settings → MCP, click Loginnext to the server once it shows “Needs login”.

VS Code (GitHub Copilot agent mode)

Add to .vscode/mcp.json:

{
  "servers": {
    "ocean": {
      "type": "http",
      "url": "https://api.anticheat.ac/mcp"
    }
  }
}

Start the server from the editor; VS Code prompts for the OAuth login.

Windsurf

Add to ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "ocean": {
      "serverUrl": "https://api.anticheat.ac/mcp"
    }
  }
}

Gemini CLI

Add to ~/.gemini/settings.json:

{
  "mcpServers": {
    "ocean": {
      "httpUrl": "https://api.anticheat.ac/mcp"
    }
  }
}

Any other MCP client

Point it at https://api.anticheat.ac/mcp. The client needs Streamable HTTP support and OAuth 2.1 with PKCE, and must support either Dynamic Client Registration or Client ID Metadata Documents — discovery starts from https://api.anticheat.ac/.well-known/oauth-protected-resource/mcp. To debug a connection by hand, use the MCP Inspector:

npx @modelcontextprotocol/inspector

Then pick transport Streamable HTTP and enter the URL above.

Tools

Each tool maps to the same permission scope as its REST endpoint. A tool call fails if the account behind the connection has not granted the matching scope.

Tool	Scope	Description
lookup_scanned_user	`scanned-users:lookup`	Query complete scan history, detections, ban/warn status, and related accounts for a Discord user
get_user_risk_score	`user:risk-score`	Get calculated risk score and level for a Discord user
create_scan_pin	`pins:create`	Create scan pins programmatically. Enterprise owners only, takes an `enterpriseId` argument
get_scan_pin_status	`pins:status`	Get real-time scan progress, status percentage, and result summary for your pins
get_scan_pin_results	`pins:results`	Retrieve scan results for your own pins
query_cheater_database	`db:query` (DB Access)	Search the cheater database by Discord ID: community profile, network lookup, and Ocean scan matches
get_client_version	none	Read the currently active Ocean client version

⚠ Scopes follow the same license rules as API keys

Granting a scope during the OAuth consent screen does not bypass the underlying license check. db:query is only grantable to accounts with an active DB Access plan, an Enterprise database seat, or a staff role, and pins:create is only grantable to accounts that own an active Enterprise, requiring an enterpriseId argument on every call.

Limits and Disconnecting

Limit	Value
Rate limit	1,000 requests per hour per account (every POST to `/mcp` counts, including `initialize` and `tools/list`; `429` when exceeded)

Revoke an MCP connection at any time from Settings → Connected apps in the Ocean dashboard.

Troubleshooting

Symptom	Meaning
`401` with a `WWW-Authenticate` header	Access token missing or expired. Reconnect the server (most clients refresh automatically; if not, remove and re-add it)
Tool call returns `isError` naming a scope	The connection was authorized without that scope. Disconnect and reconnect, granting the permission on the consent screen
`create_scan_pin` fails with a permission error	It requires an `enterpriseId` argument and only works for accounts that own that active Enterprise
`429`	1,000 requests per hour per account has been reached; wait for the window to reset

OAuth Details for Implementers

Building your own MCP client against Ocean? The server implements OAuth 2.1 with mandatory PKCE (S256) and follows the MCP authorization specification.

Detail	Value
Authorization server metadata	`https://api.anticheat.ac/.well-known/oauth-authorization-server`
Protected resource metadata	`https://api.anticheat.ac/.well-known/oauth-protected-resource/mcp`
Client registration	Dynamic Client Registration for public clients, or Client ID Metadata Documents
PKCE	Required, S256
Access token lifetime	15 minutes
Refresh tokens	Rotated on every use