📡 The Bits MCP is live — and it needs no account at all
Our third MCP server is now answering at https://mcp.cert-ix.com/bits, and it is the first one
that needs no account, no API key and no waiting. Point an MCP-capable client at the URL and
start asking.
claude mcp add --transport http bits https://mcp.cert-ix.com/bits
That is the entire setup. No --header, because there is no key to send.
What you can ask
The bits agents run on your own machines and report what those machines are. Choosing between them, and configuring them correctly, used to mean reading four sets of documentation. Now you can ask:
| Tool | Answers |
|---|---|
bits_recommend | "I need X" → which agent fits, including "none of these do" |
bits_explain | What an agent observes, what it never touches, what privilege changes |
bits_platforms | Which OS and architecture each agent ships on today |
bits_plan_config | A host profile → a complete config, plus what it will not do |
Why it can be anonymous
Because of what it deliberately cannot do. It reads the public release catalogue and nothing else. It knows no tenant, no host and no user. It cannot see your fleet, cannot enrol an agent, and cannot change anything anywhere.
Enrolling and deploying still happen inside your dashboard, from a signed-in session. An AI client can help you prepare; only you can act on your estate.
The part we care about most
An AI client relays whatever it receives as though it were certain. So the tools are built to make that safe:
It never guesses. If the release catalogue cannot be read — or can be read but not verified — you get an explicit failure, never an empty list. "We looked and found nothing" and "we could not look" are different answers, and only one of them is safe to act on.
It never collapses separate facts. An agent can ship a signed binary for a platform, not yet have an enrolment path, and never report a heartbeat. Those are three independent facts and they stay apart. Flattening them into "supported: yes" would be true and misleading.
It never writes an acknowledgement for you. Some settings require the operator to assert
something — most importantly, that you are legally authorised to send unsolicited packets onto a
network. bits_plan_config will describe the setting and refuse to make the claim on your behalf.
It tells you what a config will not do. Every generated config comes with that section. Read it before you deploy: an agent that starts cleanly and quietly collects nothing is worse than one that refuses to start.
Everything comes back in English and French.