API MCP (beta)

The Flare API MCP server is still in beta and is subject to change.

Flare provides a Model Context Protocol (MCP) server that exposes Flare’s search and platform APIs to any MCP-capable client. It lets agents query Flare’s threat-intel dataset, investigate a tenant’s monitored events, and manage monitoring configuration such as identifiers and severity rules, without writing any code against the REST API. The server supports two authentication methods: OAuth, where you sign in with your Flare account, and API keys. See Choosing an authentication method. For a documentation-only companion server (search across the Flare API docs themselves), see the Documentation MCP .

Available Tools

The server exposes over 30 tools. Highlights:

Area	Example tools	What they do
Search	`search_global`, `search_tenant`, `search_validate_search_query`	Run Lucene queries against the whole Flare dataset or your tenant’s events, and validate them.
Events	`events_get_event`, `events_expand_event`, `events_get_event_type`	Fetch a full event, expand related data, and look up an event type’s searchable fields.
Identifiers	`identifiers_list`, `identifiers_create`, `identifiers_explain_event`	Manage monitored identifiers and explain why an event matched (or didn’t match) one.
Identifier groups	`identifier_groups_list`, `identifier_groups_create`	Organize identifiers into groups.
Matching policies	`matching_policies_list`, `matching_policies_create`	Configure how identifiers match events.
Severity rules	`severity_rules_list`, `severity_rules_create`	Configure how events are scored.
Threat-intel entities	`entities_search`	Look up threat actors, malware, campaigns, and other curated entities.
Profile	`profile_get`	Return the current user’s profile, tenants, and permissions.

To see every tool and its parameters, ask your MCP client to list the server’s tools.

Some tools create, edit, or delete tenant configuration. Tool calls run with your user’s permissions.

search_global requires the Global Search permission on the target tenant. Each call counts against the tenant’s monthly Global Search quota.For additional information, please refer to Global Search Quota.

Prompt Examples

What has Flare picked up on our monitored domain scatterholt.com in the last 24 hours?
Search the whole Flare dataset for chat messages mentioning "acme-corp" in the last 7 days.
Why did this event match our identifiers?
Create an identifier for the domain scatterholt.com.
What fields can I search on the stealer_log event type?
Which tenants do I currently have access to?

Connecting to the Server

The MCP server is available at the following URL:

https://api.flare.io/mcp

Choosing an authentication method

	OAuth	API key
Clients	Claude connectors (claude.ai and Claude Desktop), ChatGPT	Claude Code and other clients that can set request headers
Setup	Enter the server URL and sign in with your Flare account	Generate an API key and set it in the `Authorization` header
Acts as	Your own user	The API key’s user
Tenant	Your default tenant	Your default tenant, or any tenant you can access via `X-Flare-Tenant-Id`

OAuth Setup

OAuth connections use your default tenant. To work in another tenant, connect with an API key and set X-Flare-Tenant-Id (see Targeting a specific tenant).

Claude (claude.ai and Claude Desktop)

Go to Settings → Connectors → Add custom connector.
Enter https://api.flare.io/mcp.
Click Connect and sign in with your Flare account.

The connector is then available in both claude.ai and Claude Desktop.

ChatGPT

Go to Plugins → Add → Add custom MCP server.
Enter https://api.flare.io/mcp and choose OAuth authentication.
Sign in with your Flare account when prompted.

API Key Setup

Authentication

In the configurations below, replace <api-key> with a Flare API key. Follow the Authentication Guide to generate one.

Targeting a specific tenant

Requests default to your account’s default tenant. To scope MCP tool calls to a specific tenant, set the X-Flare-Tenant-Id header on the MCP connection to the target tenant id. The header is optional: omitting it uses your default tenant. You can find your tenant ids via the profile_get MCP tool, or on the Profile page under the “Tenants” section (also documented in the Authentication Guide ).

Claude Code

The quickest way to add the server to a project’s config is through the Claude Code CLI:

claude mcp add flare --transport http https://api.flare.io/mcp \
  --scope project \
  --header "Authorization: <api-key>" \
  --header "X-Flare-Tenant-Id: <tenant-id>"

Alternatively, you may create an .mcp.json file at the root of your project and restart Claude Code once the file is in place:

.mcp.json

{
  "mcpServers": {
    "flare": {
      "type": "http",
      "url": "https://api.flare.io/mcp",
      "headers": {
        "Authorization": "<api-key>",
        "X-Flare-Tenant-Id": "<tenant-id>"
      }
    }
  }
}

The Flare tools will appear under the flare server in the /mcp command output, and Claude will call them automatically when your prompts match their descriptions.

Store the API key outside version control. Claude Code also supports reading headers from environment variables — see the Claude Code MCP docs for details.

Quotas & Rate Limits

Calls to search_global (Global Search) consume the tenant’s monthly Global Search quota. See Rate Limits and Quotas .
Standard API rate limits apply to all tools.

Introduction

Base Concepts

SDK, MCP & CLI

Advanced

Guides

API MCP (beta)

Available Tools

Prompt Examples

Connecting to the Server

Choosing an authentication method

OAuth Setup

Claude (claude.ai and Claude Desktop)

ChatGPT

API Key Setup

Authentication

Targeting a specific tenant

Claude Code

Quotas & Rate Limits

​Available Tools

​Prompt Examples

​Connecting to the Server

​Choosing an authentication method

​OAuth Setup

​Claude (claude.ai and Claude Desktop)

​ChatGPT

​API Key Setup

​Authentication

​Targeting a specific tenant

​Claude Code

​Quotas & Rate Limits

Available Tools

Prompt Examples

Connecting to the Server

Choosing an authentication method

OAuth Setup

Claude (claude.ai and Claude Desktop)

ChatGPT

API Key Setup

Authentication

Targeting a specific tenant

Claude Code

Quotas & Rate Limits