MCP server reference

Overview

The Ironfang MCP server is a remote Model Context Protocol server. One endpoint serves Ironfang Render, Ironfang Audit, Ironfang Finance and Ironfang Rig:

https://mcp.ironfang.com/mcp

MCP is not a separate product and has no separate price. It is another safe way to use the products you already have: rendering and audits spend the organisation's ordinary credits, reads are free, and each connection has its own spending budget (see credits and budgets).

Client compatibility

The server speaks standard OAuth. Claude Code and claude.ai are tested by us; other MCP clients connect through the same standards.

Claude Code

claude mcp add --transport http ironfang https://mcp.ironfang.com/mcp

Then inside Claude Code run /mcp, pick ironfang and choose Authenticate. A browser tab opens at id.ironfang.com: sign in, pick the organisation this connection acts for, review the scopes and allow. The tab closes and the tools appear.

Claude Desktop and claude.ai

Settings → Connectors → Add custom connector, name it Ironfang and enter https://mcp.ironfang.com/mcp. The same sign-in follows.

Never paste an API key into a chat. The MCP server does not accept Ironfang API keys as a credential; keys stay with the REST API where they belong.

Authentication

The server is an OAuth 2.1 protected resource. An unauthenticated request answers 401 with a WWW-Authenticate challenge that points at the resource metadata document; from there a client discovers the authorization server and completes the code flow with PKCE (S256). The flow, from the client's side:

1. Read https://mcp.ironfang.com/.well-known/oauth-protected-resource/mcp.
2. Read https://id.ironfang.com/.well-known/oauth-authorization-server.
3. Identify itself: by a Client ID Metadata Document (an HTTPS URL as the client id, preferred), or by registering as a public client at /oauth/register.
4. Send the person to /oauth/authorize with resource=https://mcp.ironfang.com/mcp, the scopes it wants and a PKCE challenge.
5. The person signs in, chooses one organisation and consents. A connection is one person, one organisation, one client.
6. Exchange the code at /oauth/token. The access token is short-lived and addressed only to the MCP resource; a rotating refresh token keeps the connection alive without asking again.

Scopes

Scopes are the product's own. A scope is granted only if the person holds the matching permission in the organisation they chose, and it is checked again live on every call - losing a permission ends the access the same minute.

A tool whose scope was not granted is still listed, so a client can ask for it: the call answers 403 with the complete scope set in the challenge and the client runs the flow again for the extra scope.

What the server does with the token

Nothing leaves the MCP server carrying your MCP token. To call a product it asks id.ironfang.com for a separate two-minute token addressed to that product, limited to the scopes you granted and to the organisation you chose, and marked as acting on your behalf. Products refuse an MCP token outright, and the MCP server refuses portal or product tokens.

Revoking

Disconnect a client from the portal's AI clients page or from your account settings at id.ironfang.com. Revocation ends the refresh token family and the connection; a live access token stops working within thirty seconds, not at its expiry.

Ironfang Render tools

Tool inputs are strict JSON Schema objects: unknown fields are rejected rather than ignored, and every string, size and duration is bounded. Rendering tools take a public URL or bounded raw HTML. They do not accept cookies, authorization headers, custom request headers, proxy settings, scripts to execute, or private network targets.

Cached repeats are free, exactly as on the REST API, and free-plan output branding is the same whichever way you render. Every tool carries hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) and namespaced metadata naming its scope, product, credit behaviour and risk, so a client can show a person what a call will do before it does it.

Jobs, tasks and results

Every creation tool queues a durable Ironfang Render job and answers at once with the same envelope, so a retry or a dropped connection never loses or duplicates work:

{
              "request_id": "01a0...",
              "job_id": "01a0...",
              "status": "queued",
              "product": "render",
              "kind": "screenshot",
              "cached": false,
              "credits": { "reserved": 1, "charged": 0 },
              "result": null,
              "created_at": "2026-08-27T23:09:45Z",
              "connection_id": "01a0..."
            }

Poll render.job.get (or read the job resource). Once status is succeeded, result holds the media type, byte size, SHA-256, the moment the hosted result expires, and a download link:

• Hosted results are kept for 24 hours after success.
• Download links are signed and valid for 15 minutes; every read of the job or its result resource issues a fresh one.
• Links are the default even for screenshots. PDFs, clips and full-page images are never returned inline; a screenshot under 2 MiB can be, only when a client asks for it explicitly.
• For longer retention, download the result, or name a webhook or storage destination in the create tool's delivery block (render.destination.list shows what the account has).

A client that speaks the io.modelcontextprotocol/tasks extension asks for a task by putting a task object in the tools/call params. It then receives a task handle for screenshot, PDF and template work and must use one for clips; tasks/get mirrors the job's state, tasks/result returns the envelope and tasks/cancel is a cooperative cancel. Other clients get the envelope above and poll. Both roads end at the identical terminal result. Audits follow the same shape without tasks: audit.audit.create answers at once and audit.audit.get reports progress. Ironfang Rig's one blocking call, rig.event.wait, is bounded at sixty seconds and a timeout is an answer.

Resources

Read-only metadata is also exposed as resource templates, for clients that prefer to attach context rather than call tools. There is no enumeration of your objects; ids come from tool results.

Credits and budgets

There is no MCP fee. Connecting, listing tools, reading usage and reading metadata are free. Rendering spends ordinary Ironfang Render credits at the ordinary rate, and failed or cancelled work follows the same refund rules as the REST API. Starting an audit spends Ironfang Audit credits the same way, against a separate connection budget. Ironfang Finance and Ironfang Rig tools cost nothing.

On top of the plan's cap, every connection has its own budget so a looping agent cannot spend a month's allowance in an afternoon:

connection budget = max(25, 10% of the plan's monthly credits)
                                capped by the organisation's remaining allowance
                                per billing period

Before chargeable work the server reserves the tool's maximum cost against the budget, then settles to what the product actually charged and releases the rest; ironfang.connection.get shows the allowance, what is reserved, what has been settled, what remains and when it resets. An exhausted budget answers mcp_budget_exhausted with the reset time; the plan cap answers the product's usual quota_exceeded.

Ironfang Audit tools

Read sites, audits, findings, rules and usage, and start a bounded audit of a site. Changing a rule, a site, a monitor or a finding stays in the portal and the REST API. Starting an audit reserves one credit per page the site's crawl policy allows, up to 200, against the connection's Ironfang Audit budget, and settles at what the audit consumed. Page text inside a finding is content observed on a website and is labelled untrusted. An evidence bundle is never served through the connection: its resource says where the bundle is and how to verify it. Nothing here exposes integration secrets, rule editing, schedules or retention controls to a model.

Ironfang Finance tools

Reference only: what a validation rule means and how to fix it, and which rulesets the validator runs. Validating and generating documents, results and jobs are REST-only; the Ironfang Finance API takes a platform API key and has no OAuth delegation yet. The rule tools answer from the same reviewed explanations as the validation rule reference, so an assistant handed a finding such as BR-CO-10 can say what it means and how to fix the invoice. They need only ironfang:mcp, cost nothing and need no Ironfang Finance account. To validate or generate a document, call the REST API with a platform API key, or use the free validator.

Ironfang Rig tools

The Ironfang Rig product as tools, so an assistant can give the application it is working on a disposable outside world: a fresh inbox, a public callback URL, a mock endpoint or a route to a local port, then wait on the timeline, interfere on purpose and export the evidence. Every tool is bound to the connection's organisation and costs no credits. Payload bytes are never returned through the connection: the tools return what the timeline recorded, labelled as third-party content, and point at the API for the rest. Starting a run has a public effect, which the tool says: its addresses accept mail and requests from anyone for the life of the run.

Discovery

Everything a registry, a scanner or a coding agent needs to understand the server can be read without a token. Calling a tool always needs one.

After connecting, initialize returns short instructions naming each tool prefix and where to start, tools/list returns every tool with its schema, hints and metadata, and ironfang.connection.get returns the organisation, scopes, products and budgets of this connection.

Names and compatibility

Renderwolf, Auditwolf and Financewolf are the names Ironfang Render, Ironfang Audit and Ironfang Finance launched under. They are not separate products. An alias is the name a product launched under. It is callable so that saved configurations keep working, it is never listed by tools/list, and it is not a separate product. Resource URIs under the alias names resolve the same way. Use the current names.

Scopes follow the same rule: a token or key minted with a launch-era scope such as renderwolf:render is read as render:render. New connections are only ever offered the current names.

Security

• The MCP access token is addressed to https://mcp.ironfang.com/mcp and nowhere else; products reject it, and the MCP server rejects tokens meant for the portal or a product.
• Product calls use a separate two-minute token minted per call, limited to your granted scopes and your chosen organisation, and never a stored key.
• Scopes are re-checked against your live organisation permissions on every call, and the connection's grant status with a fail-closed cache of at most thirty seconds.
• Client identity is a Client ID Metadata Document fetched over HTTPS with private-network, redirect and size protections, or a rate-limited public-client registration that is retired after thirty days unused. Registrations cannot choose their own scopes.
• Rendering tools refuse cookies, authorization and custom headers, proxies, script execution and private-network targets. Raw HTML is bounded and never logged.
• Signed download links expire in fifteen minutes and are bound to the job's organisation.
• There is no tool that mints keys, manages members or clients, changes plans, deletes evidence or calls an arbitrary API.
• Per-connection and per-organisation concurrency limits, per-call cost ceilings and a per-tool kill switch bound the damage a misbehaving client can do.

Troubleshooting

Every response carries X-Ironfang-Request-ID; a request id or the connection id from ironfang.connection.get is all support needs to find a call. Quote those, never a token.

Privacy

For each MCP call Ironfang records the connection id, organisation, tool name, method, outcome, latency, request size and request id. It does not record tool arguments, prompts, tool results or model output. Rendered outputs are stored as Ironfang Render jobs under the organisation's ordinary retention (24 hours for hosted results) and are visible to that organisation in the portal. Consent screens and registrations are recorded as security events on the account. Disconnecting a client revokes its tokens; it does not delete the jobs the organisation already paid for.