Getting Started with SecCheck

SecCheck is a hosted MCP server. You connect your AI client to it once, and from then on the client's agent can search and load security playbooks whenever a task calls for one.

There are two ways to run it:

1. Hosted (recommended) — connect to https://mcp.cert-ix.com/seccheck over the network. Nothing to install; always on the current corpus.
2. Local (stdio) — run the security-skills-mcp binary next to your agent for a fully offline setup. The local build is not a public download today — see Option 2.

Prerequisites

• An MCP-capable client: Claude Code, Claude Desktop, Cursor, VS Code (with an MCP extension), or any client that speaks streamable-HTTP MCP.
• A SecCheck API key — free, self-service, no Cert-IX account required. Request one at cert-ix.com/tools/seccheck-mcp: confirm your email address and the key arrives by email. A free key is the Community edition and lasts 90 days; before it expires you receive an email with a renewal link, and the same key keeps working. It is sent as a Bearer token on every request, so treat it like a password — see Security & data handling.

info

The hosted endpoint requires an API key. Requests without a valid Authorization: Bearer <key> header are rejected with 401. Your key also carries your edition — see Editions.

Option 1 — Hosted endpoint

Claude Code (CLI)

Add the server with the claude mcp command:

claude mcp add --transport http seccheck https://mcp.cert-ix.com/seccheck \
  --header "Authorization: Bearer YOUR_API_KEY"

Verify it registered and the tools are visible:

claude mcp list

You should see seccheck with seven tools: list_sources, search_skills, load_skill, list_skill_resources, read_skill_resource, license_status, and get_attribution.

Claude Desktop / Cursor / generic MCP client

Add an entry to your client's MCP configuration. Most clients accept a streamable-HTTP server block like this:

{
  "mcpServers": {
    "seccheck": {
      "type": "http",
      "url": "https://mcp.cert-ix.com/seccheck",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

Restart the client after saving. The exact file location varies by client (Claude Desktop uses claude_desktop_config.json; Cursor uses its MCP settings panel) — the server block above is the part that matters.

Sanity check with curl

The endpoint is a standard MCP server, so you can confirm reachability and auth with a raw initialize call:

curl -sS -D- https://mcp.cert-ix.com/seccheck \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize",
       "params":{"protocolVersion":"2025-06-18",
                 "capabilities":{},
                 "clientInfo":{"name":"curl","version":"1.0"}}}'

A 200 with a JSON-RPC result means auth and connectivity are good. A 401 means the key is missing or wrong; a 429 means you have hit the rate limit (see Security & data handling).

Sessions: echo the mcp-session-id header

SecCheck's hosted transport is session-based. The initialize response carries an mcp-session-id header, and every subsequent request must send it back:

-H "mcp-session-id: mcp-session-<uuid-from-initialize>"

Without it, follow-up calls fail with 400 Invalid session ID. MCP clients handle this for you — it only matters when you are probing by hand with curl.

Option 2 — Local (stdio)

Not a public download today

The local build is not distributed publicly yet. If you need SecCheck in an air-gapped or high-assurance environment, talk to your Cert-IX account team. The configuration below applies once you have the binary.

For air-gapped or high-assurance work, run the server locally over stdio. The binary carries the corpus, so it needs no network at all.

{
  "mcpServers": {
    "seccheck": {
      "command": "security-skills-mcp",
      "env": {
        "SKILLS_LICENSE": "/etc/cert-ix/seccheck.license"
      }
    }
  }
}

Setting	Purpose
SKILLS_ROOT (-root)	Directory holding the skill repositories, when running against on-disk sources instead of the embedded corpus.
SKILLS_LICENSE (-license)	Path to a signed offline licence file. Absent or unverifiable ⇒ Community edition.
SKILLS_AUDIT_LOG (-audit-log)	Append tool-call audit records here (Enterprise).
SKILLS_USAGE (-usage)	Write usage metering here (Enterprise).

Check what the local instance resolved before wiring an agent to it:

security-skills-mcp -stats

It prints the indexed skill count per library and the active edition to stderr, then exits.

Hosted vs local: two differences

• Entitlements. Hosted, your edition comes from your API key and is resolved by the Cert-IX edge on every request. Local, it comes from a signed licence file read once at start-up.
• MCP resources. The local stdio server additionally exposes every playbook as an MCP resource under skill://<source>/<name>, so clients with a resource picker can browse the library directly. The hosted endpoint exposes tools only; use search_skills + load_skill instead.

The seven tools, their parameters and their responses are identical in both modes.

First call

Once connected, ask your agent something like:

"We think someone is Kerberoasting our AD. Find the detection playbook and walk me through it."

The agent will call search_skills(query="kerberoasting", category="defensive"), get back cybersecurity/detecting-kerberoasting-attacks, load it with load_skill, and follow the procedure in it — when the hunt applies, the telemetry it needs first (EDR, SIEM, forwarded Windows Security event logs), and ordered steps from a hypothesis to validated, documented findings, mapped to the relevant MITRE ATT&CK techniques.

That is the whole point: the agent's next steps come from a written hunting procedure — one you can open and check — instead of from improvisation.

Continue to the Tools reference for the full parameter set of each tool, or Agent workflows for the search → load → follow discipline.