# MCP (/docs/mcp)



Elmo serves a [Model Context Protocol](https://modelcontextprotocol.io) endpoint at `/api/mcp`, so an
AI client can read your visibility data and manage prompts without you copying numbers between
windows.

Connections authenticate with an API key. Issue one from **Settings → API keys** in the organization's
settings sidebar — keys belong to the organization, so they are not found under a brand. Tick only the
scopes you want and optionally narrow the key to selected brands: that is how you grant a client
*less* than your own access.

## Cloud [#cloud]

The endpoint is `https://app.elmohq.com/api/mcp`.

Claude Code:

```bash
claude mcp add --transport http elmo https://app.elmohq.com/api/mcp \
  --header "Authorization: Bearer elmo_..."
```

OpenCode, in `opencode.json`:

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "elmo": {
      "type": "remote",
      "url": "https://app.elmohq.com/api/mcp",
      "enabled": true,
      "headers": { "Authorization": "Bearer elmo_..." }
    }
  }
}
```

## Self-hosted [#self-hosted]

Every instance serves the same endpoint on its own address:

```
https://<your-instance>/api/mcp
```

```bash
claude mcp add --transport http elmo https://<your-instance>/api/mcp \
  --header "Authorization: Bearer elmo_..."
```

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "elmo": {
      "type": "remote",
      "url": "https://<your-instance>/api/mcp",
      "enabled": true,
      "headers": { "Authorization": "Bearer elmo_..." }
    }
  }
}
```

Keys come from the same organization settings page as on cloud, and instance-wide admin keys can also
be configured server-side through the `ADMIN_API_KEYS` environment variable. Nothing else has to be turned on — the
endpoint is there as soon as the instance is.

## Try [#try]

> What is the visibility and share of voice for each tagged prompt in Elmo for `<brand>`?

> What are some AEO opportunities for my `<brand>`?

> Give me an example run for my `<description>` prompt.

## Scopes [#scopes]

A connection is only offered the tools its scopes allow, so a client is never shown something it
would then be refused:

| Scope              | MCP tool                                                                                            |
| ------------------ | --------------------------------------------------------------------------------------------------- |
| *(none)*           | `whoami`, `list_models`                                                                             |
| `brands:read`      | `list_brands`, `get_brand`                                                                          |
| `competitors:read` | `list_competitors`                                                                                  |
| `prompts:read`     | `list_prompts`, `list_prompt_tags`                                                                  |
| `prompts:write`    | `create_prompts`, `update_prompt`                                                                   |
| `analytics:read`   | `get_analytics`, `get_prompt_performance`, `get_citations`, `get_query_fanout`, `get_opportunities` |
| `runs:read`        | `list_runs`, `get_run`                                                                              |
| `billing:read`     | `get_billing`                                                                                       |

`brands:write`, `competitors:write` and `competitors:delete` matter to the [REST API](/docs/api) only.
MCP can create and edit prompts, but nothing deletes data and nothing changes billing.