Practical documentation

Connect Binary³ MCP.

Use this supported configuration shape in a compatible MCP client. The machine endpoint is a protocol surface, not a human landing page.

{
  "mcpServers": {
    "binary3": {
      "type": "http",
      "url": "https://mcp.binarycubed.com/mcp",
      "headers": {
        "Authorization": "Bearer <BINARY3_MCP_API_KEY>"
      }
    }
  }
}

Authentication overview

Every MCP protocol request uses an issued bearer credential in the HTTP Authorization header. Binary³ validates the credential signature against its public JWKS, then validates issuer, audience, lifetime, credential identity, tenant binding, and the requested tool entitlement.

The public verification keys are discoverable at the qualified JWKS URL below. Never place a credential in source control, a public document, or client-side browser code.

Current tools

Tool	Input	Use
`keysweep_scan_text`	`text: string`	Inspect supplied text for exposed secrets. Pure analysis; no network access.
`microdefend_scan_website`	`url: string`	Scan a public URL you are authorized to scan.

Safe result fields

KeySweep returns redacted service output. Fields include status, risk_level, confidence_score, summary, detections, and text_length. A detection can include type, severity, confidence, fingerprint, and value_length. Detected secret values are not returned.

MicroDefend returns status, scan_id, findings, and a redacted result.

Authentication and error states

HTTP 401: the bearer credential is missing, malformed, expired, unknown, or otherwise invalid.
forbidden: the credential does not carry the requested tool entitlement.
credential_binding_failed: the live credential and tenant authorization could not be established.
invalid_text / text_too_large: the KeySweep input does not meet the tool contract.
rate_limit_exceeded: the credential's available scan quota is exhausted.
quota_unavailable / binding_check_unavailable: an authorization control could not be verified, so execution failed closed.
scan_failed: the downstream security scan did not complete successfully.

Tool errors are returned in an MCP-safe form. Retry only transient availability errors; changing or bypassing authentication is not a recovery path.

Public JWKS

The qualified public verification-key surface is https://binarycubed.com/.well-known/mcp-jwks.json. The public JWKS and unauthenticated fail-closed behavior are production-qualified; authenticated MCP end-to-end operation is not yet independently qualified.

Back to MCP overview Commercial access