Connect an AI assistant

WebDecoy runs a hosted MCP server at https://mcp.webdecoy.com/mcp. Connect your AI assistant to it and you can ask it to install WebDecoy in the app you are working on, check the install is reporting, and answer questions about your sites: whether protection is actually enforced, which bots were seen, and what an actor did.

You choose what each assistant sees. The first time an assistant asks for data, it gives you an approval link. Open it, tick the sites that assistant may read, and approve. Review or disconnect an assistant any time in Settings, Connected apps.

Claude Code

Install the WebDecoy plugin:

/plugin marketplace add WebDecoy/claude-plugins
/plugin install webdecoy@webdecoy

Restart Claude Code, run /mcp and sign in to webdecoy. Then ask it to “install WebDecoy in this app”, or run /webdecoy:install. The plugin adds the MCP server, an install skill that follows WebDecoy’s own guide for your stack, and the /webdecoy:install command. Source: WebDecoy/claude-plugins.

Claude.ai and Claude Desktop

In Settings, Connectors, choose Add custom connector and enter:

https://mcp.webdecoy.com/mcp

Claude opens WebDecoy’s sign-in. After you sign in, ask Claude about your sites.

Codex

codex mcp add webdecoy --url https://mcp.webdecoy.com/mcp
codex mcp login webdecoy --scopes mcp:read,mcp:setup,offline_access

ChatGPT

In Settings, Apps and Connectors, turn on developer mode and choose Create. Enter https://mcp.webdecoy.com/mcp as the server URL with OAuth authentication, and under the advanced OAuth settings choose dynamic client registration.

Other assistants: the WebDecoy CLI

For an assistant that runs MCP servers as local commands (Claude Desktop, Cursor and others), install the WebDecoy CLI and sign in once. The CLI runs on macOS and Linux (Intel and ARM); there is no Windows build.

brew install webdecoy/tap/webdecoy
webdecoy login

No Homebrew? Download a binary from Releases and check it against checksums.txt.

webdecoy login shows a code; approve it in your browser. Then approve which sites the CLI may read at app.webdecoy.com/connect/mcp, and run webdecoy status to check. Add it to your assistant as the command webdecoy mcp. For Claude Desktop, in claude_desktop_config.json:

{"mcpServers": {"webdecoy": {"command": "webdecoy", "args": ["mcp"]}}}

If your assistant does not see your shell’s PATH, use the full path from which webdecoy as the command.

The login is kept in the macOS Keychain or the Linux Secret Service, never in a file. webdecoy logout signs out; webdecoy logout --disconnect also removes the CLI’s site approval. Binaries and source: WebDecoy/cli.

What the assistant can do

Tool	What it does
`list_properties`	The sites you approved for this assistant
`get_protection_status`	Whether a site is actually protected, and why not
`search_detections`	Bot detections on a site, filterable by time and score
`get_actor_evidence`	What one actor did across a site
`get_current_policy`	What the site’s policy is configured to do
`get_install_guide`	Install steps for your stack, with your public IDs filled in
`get_install_status`	Whether the install is reporting, plus a test request to prove it
`create_script_tag`	Create a site’s detection script (needs setup permission)
`verify_install`	Check one of your own pages serves the WebDecoy tag (needs setup permission)
`list_decoys`	The decoys on a site and their URLs
`create_decoy`	Create a decoy and get the code to hide it in your site (needs setup permission)
`create_site`	Add a new site, if you own the organization (needs setup permission)

What it cannot do

It reads by default. The setup tools (creating sites, decoys and script tags, and checking an install) work only if you tick Also allow setup when you approve the assistant. A site the assistant creates is added to that assistant’s access; sites it did not create still need your approval. Sites and decoys count toward your plan’s limits.
It never changes your policies, enforcement, settings or billing. Those stay in the dashboard.
It never receives secret keys. Install guides name the environment variables your app needs, and you set their values yourself.

Data an assistant reads is sent to that assistant’s provider. See section 4.5 of the privacy policy.