> For the complete documentation index, see [llms.txt](https://docs.gomboc.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.gomboc.ai/integrations/mcp-server.md).

# Gomboc MCP Server

The hosted Gomboc [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server gives AI coding agents access to Gomboc rules, classifications, and channels. The [Gomboc Community Skills](/orl/agent-skills/gomboc-community-skills.md) and [Gomboc Enterprise Skills](/orl/agent-skills/gomboc-enterprise-skills.md) use MCP when it is available and fall back to the ORL runtime or local references when it is not.

The hosted endpoint is:

```
https://mcp.app.gomboc.ai/mcp
```

## Capabilities

The available tools are discovered by your MCP client and may change over time. Current capabilities include:

* Looking up channels and listing the rules in a channel
* Searching for and retrieving rules
* Looking up and searching policy classifications
* Searching channels
* Reporting an external ORL run

Code remediation, AST walking, rule tests, and publishing rules continue to use the ORL runtime rather than MCP.

## Prerequisites

Before configuring the server:

1. Install an MCP-compatible AI coding agent, such as Cursor.
2. [Generate a Gomboc Personal Access Token](/getting-started/generate-a-personal-access-token.md).
3. Make the token available to the process that launches your agent:

```bash
export GOMBOC_PAT="<your-token>"
```

{% hint style="warning" %}
Treat your personal access token as a secret. Do not add it directly to an MCP configuration file, commit it to source control, or print it in logs.
{% endhint %}

## Configure Cursor

Add the following server definition to your global `~/.cursor/mcp.json` file or your project's MCP configuration:

```json
{
  "mcpServers": {
    "gomboc": {
      "url": "https://mcp.app.gomboc.ai/mcp",
      "headers": {
        "Authorization": "Bearer ${env:GOMBOC_PAT}"
      }
    }
  }
}
```

Restart Cursor after setting the environment variable or changing the configuration. If you install the Gomboc Enterprise Skills plugin, Cursor may offer to add this server definition automatically.

## Verify the connection

Use the verification command provided by your Gomboc skills package:

| Package                  | Command                        |
| ------------------------ | ------------------------------ |
| Gomboc Community Skills  | `/gomboc-community:verify-mcp` |
| Gomboc Enterprise Skills | `/gomboc:verify-mcp`           |

Verification succeeds when the `gomboc` server is ready, its tools can be listed, and a read-only `get_channels` request for the `default` channel completes successfully.

You can also verify the connection in your agent's MCP settings. The `gomboc` server should appear as connected with its tools available.

## Troubleshooting

If verification fails:

* Confirm that `GOMBOC_PAT` is set in the environment that launches your agent.
* Confirm that the server URL is exactly `https://mcp.app.gomboc.ai/mcp`.
* Check that the authorization header uses `Bearer ${env:GOMBOC_PAT}`.
* Confirm that the personal access token is active.
* Restart the agent after changing the environment or MCP configuration.

An unavailable MCP connection does not block Gomboc skills. They fall back to the Rules Service, Docker-based ORL runtime, or local references as appropriate.