> ## Documentation Index
> Fetch the complete documentation index at: https://docs.formal.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Formal MCP

> Connect an MCP client to Formal API behavior and organization state

export const G = ({term, anchor, children}) => {
  const href = anchor ? `/docs/glossary/index#${anchor}` : `/docs/glossary/index`;
  return <a href={href} className="glossary-link" style={{
    textDecoration: "underline",
    textDecorationLine: "underline",
    textDecorationColor: "#6b7280",
    textDecorationThickness: "1px",
    textUnderlineOffset: "2px",
    color: "inherit",
    transition: "text-decoration-color 0.2s ease",
    borderBottom: "none"
  }} onMouseEnter={e => e.target.style.textDecorationColor = "#fff"} onMouseLeave={e => e.target.style.textDecorationColor = "#6b7280"}>
  {children || term}
</a>;
};

## Overview

<G anchor="formal-mcp">Formal MCP</G> is Formal's hosted MCP server at
[`https://api.formal.ai/mcp`](https://api.formal.ai/mcp).
The MCP server has only read-only tool calls.

The server stays current with shipped product behavior. It can search
the API reference and query the state of your organization.

<Note>
  This is Formal's hosted server. It is not an
  [MCP resource](/docs/guides/core-concepts/resources/mcp). MCP
  resources proxy other MCP traffic through a Connector.
</Note>

## What Formal MCP can do

| Capability               | Use it to                                                                    |
| ------------------------ | ---------------------------------------------------------------------------- |
| Search the API reference | Find the current RPC, fields, and validation rules.                          |
| Search for a keyword     | Resolve a name, email, hostname, or ID in your org.                          |
| Query organization state | Read resources, policies, connectors, and other objects you can already see. |
| Read access logs         | Inspect recent traffic and group it by user, resource, or policy.            |

Calls run as the authenticated identity. The client never sees more than
you can see in the Formal console.

It cannot create or update objects.

## Connect with an API key

Authentication matches the rest of the Formal API. Send an API key in
the `x-api-key` header. See
[API authentication](/docs/api/introduction#authentication).

<Steps>
  <Step title="Create an API key">
    Go to [API Keys](https://app.formal.ai/api-keys) and click **Create
    API Key**. Copy the key once.
  </Step>

  <Step title="Add the server to your client">
    Point the client at `https://api.formal.ai/mcp` and send the key on
    every request.

    <Tabs>
      <Tab title="Claude Code">
        ```bash theme={"languages":{"custom":["/languages/cel.json","/languages/rego.json"]}}
        claude mcp add formal https://api.formal.ai/mcp \
          --header "x-api-key: <YOUR_API_KEY>" \
          --transport http
        ```
      </Tab>

      <Tab title="Cursor">
        ```json theme={"languages":{"custom":["/languages/cel.json","/languages/rego.json"]}}
        {
          "mcpServers": {
            "formal": {
              "url": "https://api.formal.ai/mcp",
              "headers": {
                "x-api-key": "<YOUR_API_KEY>"
              }
            }
          }
        }
        ```
      </Tab>

      <Tab title="Other clients">
        Use HTTP transport against `https://api.formal.ai/mcp`. Send
        `x-api-key: <YOUR_API_KEY>` on each request. The same header
        works in a CLI flag or a config file.
      </Tab>
    </Tabs>
  </Step>

  <Step title="Verify the connection">
    Ask the client to list your connectors. You should get live results
    from your organization.

    ```bash theme={"languages":{"custom":["/languages/cel.json","/languages/rego.json"]}}
    curl -s -X POST https://api.formal.ai/mcp \
      -H "x-api-key: <YOUR_API_KEY>" \
      -H "Content-Type: application/json" \
      -H "Accept: application/json, text/event-stream" \
      -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
    ```

    The response lists the read-only tools above.
  </Step>
</Steps>

<Warning>
  Treat the API key like any other Formal secret. Do not commit it to
  source control or share it in a public prompt.
</Warning>