Connect Formal MCP - Formal Documentation

Overview

is Formal’s hosted MCP server at https://api.formal.ai/mcp. The MCP server has only read-only tool calls. The server stays current with shipped product behavior. It can search the API reference and query the state of your organization.

This is Formal’s hosted server. It is not an MCP resource. MCP resources proxy other MCP traffic through a Connector.

What Formal MCP can do

Capability	Use it to
Search the API reference	Find the current RPC, fields, and validation rules.
Search for a keyword	Resolve a name, email, hostname, or ID in your org.
Query organization state	Read resources, policies, connectors, and other objects you can already see.
Read access logs	Inspect recent traffic and group it by user, resource, or policy.

Calls run as the authenticated identity. The client never sees more than you can see in the Formal console. It cannot create or update objects.

Connect with an API key

Authentication matches the rest of the Formal API. Send an API key in the x-api-key header. See API authentication.

Create an API key

Go to API Keys and click Create API Key. Copy the key once.

Add the server to your client

Point the client at https://api.formal.ai/mcp and send the key on every request.

Claude Code
Cursor
Other clients

claude mcp add formal https://api.formal.ai/mcp \
  --header "x-api-key: <YOUR_API_KEY>" \
  --transport http

{
  "mcpServers": {
    "formal": {
      "url": "https://api.formal.ai/mcp",
      "headers": {
        "x-api-key": "<YOUR_API_KEY>"
      }
    }
  }
}

Use HTTP transport against https://api.formal.ai/mcp. Send x-api-key: <YOUR_API_KEY> on each request. The same header works in a CLI flag or a config file.

Verify the connection

Ask the client to list your connectors. You should get live results from your organization.

curl -s -X POST https://api.formal.ai/mcp \
  -H "x-api-key: <YOUR_API_KEY>" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

The response lists the read-only tools above.

Treat the API key like any other Formal secret. Do not commit it to source control or share it in a public prompt.

​Overview

​What Formal MCP can do

​Connect with an API key

Overview

What Formal MCP can do

Connect with an API key