Connect AI tools
Connect Claude, ChatGPT, Cursor and other MCP clients to your Tawa Guard account with OAuth, and see what they can read.
Tawa Guard runs a hosted Model Context Protocol (MCP) server. An AI assistant that supports remote MCP servers can connect to it with OAuth and answer questions about your account: which apps you have, what was blocked, how much of your plan you have used, and how a policy is configured.
The server is read-only. It cannot create or change apps, keys, policies or billing, and it never returns unredacted scan text.
Servers
| Server | URL | Bound to | What it exposes |
|---|---|---|---|
| Tawa Guard | https://mcp.tawaguard.com/mcp | One organization | Apps, scan results, usage, policies, docs search |
| Knowledge | https://mcp.tawaguard.com/mcp/knowledge | One app | Approved documents in that app's knowledge buckets |
Both use the Streamable HTTP transport (GET, POST and DELETE on the URL)
and the same sign-in. Their tokens are not interchangeable: a token issued for
one is rejected by the other.
Tools
Every tool is annotated read-only (readOnlyHint: true). The server registers
only the tools your connection may use, so tools/list shows fewer tools if
you granted fewer scopes or your role lacks the matching permission.
Tawa Guard server
| Tool | Scope | What it returns |
|---|---|---|
search_docs | none | Matching pages from these docs, with URLs and snippets |
get_doc_page | none | The markdown of one docs page |
list_apps | apps:read | The apps you can access: name, slug, active profile |
get_app | apps:read | One app: purpose, active profile, region, gateway URL |
list_profiles | apps:read | Built-in and custom protection profiles |
get_integration_snippet | apps:read | Install command and code for TypeScript, Python or curl. The key is read from TAWA_API_KEY; no key is ever returned |
search_jobs | jobs:read | Recent scan jobs with verdict, filterable by app, verdict (ALLOW, BLOCK, AMBIGUOUS), category (prompt, rag, agent) and date. Cursor-paged, up to 100 per page |
get_job | jobs:read | Why a scan got its verdict: decision, attack categories, matched policy rules, PII categories and redacted text |
summarize_threats | jobs:read | Totals for one app over 24h, 7d, 30d or 90d: volume, verdicts, categories, top attack categories |
get_usage | usage:read | Scans used this billing period against the plan limit, usage budget and spend cap |
get_policy | policies:read | An app's active policy rules, detection settings and risk thresholds |
Apps are referred to by name or slug. If a name matches more than one app, the tool asks for the slug.
Knowledge server
| Tool | What it returns |
|---|---|
list_buckets | The knowledge buckets in the connected app and how many approved documents each serves |
search | Best matching approved documents with a snippet and when each was last scanned. Optional bucket and limit |
read | The full text of one approved document. Long documents come in parts; pass next_offset as offset to continue |
Connect a client
You need a Tawa Guard account that belongs to an organization. Connections are made by the member who signs in, not by an API key.
- Add a remote MCP server (often called a custom connector) in your client and enter the server URL from the table above.
- The client discovers the authorization server from the server's OAuth protected resource metadata and registers itself with dynamic client registration. You do not create a client ID or secret.
- Your browser opens Tawa Guard. Sign in, and complete two-factor authentication if prompted.
- If you belong to more than one organization, choose the one to connect. For the Knowledge server you also choose the app.
- Review the consent screen and select Allow.
The token is bound to the organization you chose. To use another organization, connect again and choose it.
Claude Code
Claude Code can add a remote HTTP server from the command line:
claude mcp add --transport http tawa-guard https://mcp.tawaguard.com/mcpRun /mcp inside Claude Code and authenticate the tawa-guard server to start
the sign-in described above.
Claude, ChatGPT and other clients
Add a custom connector, or a remote MCP server, and paste the URL. Where the setting lives and what it is called differs between products and plans, so follow your client's own documentation for adding a remote MCP server. Any client that supports OAuth 2.1 with dynamic client registration and Streamable HTTP can connect.
The commands and menu names for specific clients above are general guidance. The Tawa Guard side of the flow is the same for every client.
The consent screen
The heading names the client and the organization, for example "Connect Claude to Acme", and the screen shows:
- The host the client will return you to after you approve.
- A warning that Tawa Guard has not verified the app. Every dynamically registered client shows it today, so continue only if you started the connection yourself.
- One checkbox per scope. You can untick any of them.
- A reminder that the client cannot change settings, see billing details, or read unredacted scan text.
Scopes
| Scope | Consent label | Grants |
|---|---|---|
apps:read | View apps | App names, profiles and integration details |
jobs:read | View scan results | Verdicts, scores and categories. Scanned text is always redacted |
usage:read | View usage | Scans used this period against your plan |
policies:read | View policies | Active policy rules and detection settings |
knowledge:read | Read knowledge | Search and read the scanned documents in one app's knowledge buckets. Knowledge server only; it cannot be unticked |
offline_access | Stay connected | Keep access for up to 30 days without signing in again |
A scope only takes effect if your role also allows it: apps:read needs
permission to view apps, jobs:read and usage:read need permission to view
jobs, and policies:read needs permission to view settings. Permissions are
checked on every request, so a demotion or removal from the organization takes
effect immediately.
Tokens and sessions
| Property | Value |
|---|---|
| Grants | Authorization code and refresh token. No client credentials grant |
| Access token lifetime | 1 hour |
| Refresh token lifetime | 30 days (needs offline_access) |
| Token format | Signed JWT, audience is the server URL |
Disconnecting a connection deletes its consent record, which the server checks on every request, so access ends immediately rather than when the access token expires.
Disconnect a connection
Open Settings, Connected AI tools in your organization. Each row shows the client, its scopes, when it connected and when it was last refreshed. Select Disconnect on a row and confirm. The client loses access immediately and has to authorize again to reconnect.
Members see their own connections. Members with permission to manage organization settings also see every member's connections and can disconnect them.
What data is exposed
| Data | Exposure |
|---|---|
| Scan text | Redacted. Detected attack spans are replaced with [REDACTED: label] and text is capped at 4096 characters |
| Scan text containing personal data | Withheld (content is null with a reason) when PII was detected or the job was never PII-scanned |
| Scan text not retained | Withheld when your app does not store scan text |
| Free-text decision rationale | Never returned |
| API keys, secrets | Never returned. Fields whose name contains key, token, secret or password are masked in audit records |
| Billing details | Not available. get_usage returns plan, counts and spend cap only |
| Other organizations | Not reachable. Every call is checked against the organization on the token and the apps you can access |
Scan text is wrapped in <untrusted_end_user_content> tags and the server's
instructions tell the assistant to treat it as data, never as instructions.
This reduces the chance that a malicious prompt stored in your logs steers the
assistant, but your client's own prompt-injection handling still applies.
Every tool call is written to your organization's audit log with the client, the tool, its arguments and the outcome, as is every revocation.
Limits
| Limit | Value |
|---|---|
| Tawa Guard server | 300 tool calls per minute per client and user |
| Knowledge server | 120 tool calls per minute per client and user |
search_jobs page size | 1 to 100, default 20 |
search_docs results | 1 to 20, default 8 |
Troubleshooting
| Symptom | Cause and fix |
|---|---|
401 with No authorization provided | The client has not completed sign-in. Authenticate the server in the client |
401 after working earlier | The connection was disconnected, or the token expired and refresh failed. Reconnect |
403 Forbidden: no longer a member of this organization | Your membership was removed. Connect again with an organization you belong to |
| A tool is missing from the list | The scope was unticked on the consent screen, or your role lacks the matching permission. Reconnect and grant it, or ask an admin |
Not found. | The app or job does not exist or you cannot access it. The two cases are indistinguishable by design |
More than one app matches. Use the slug instead | Two apps share a name. Pass the slug from list_apps |
Rate limit reached, wait a minute. | You exceeded the per-minute limit. Retry after a minute |
Something went wrong on the Tawa Guard side. Try again shortly. | An unexpected server error. Retry |
Docs search is unavailable right now. | The docs site did not answer within 5 seconds |
Consent screen shows Something went wrong. Start again from your AI tool. | The authorization request expired. Start the connection again from the client |
You no longer have access to this app. Reconnect to choose another. (Knowledge) | You lost access to the app, or it was archived. Reconnect and choose another app |
invalid_scope at the token step | The client asked for a scope the server does not offer, or mixed the two servers' scopes. Reconnect each server as its own connection |
Introduction
Tawa Guard inspects prompts for injection and other attacks before they reach your LLM. Pick TypeScript, Python, or the raw API.
EU AI Act evidence
Generate a pack of what Tawa Guard recorded for one app over one period, set beside seven articles of the EU AI Act, and check that its files are unchanged.