Moatlight MCP server

Agents can use Moatlight as tools over the Model Context Protocol (Streamable HTTP). https://www.moatlight.com/mcp exposes the same operations as the REST API as tools; the docs server at https://www.moatlight.com/mcp/docs lets an agent search these docs.

• Moatlight: https://www.moatlight.com/mcp (server card: https://www.moatlight.com/mcp/server-card)
• Moatlight docs: https://www.moatlight.com/mcp/docs (server card: https://www.moatlight.com/mcp/docs/server-card)

Listing tools needs no login. Calling a tool that reads or writes an account sends the client through the OAuth login above (the server answers 401 with a WWW-Authenticate header). Public tools work without it.

Install

One URL is all a client needs. There is no API key: the client opens the OAuth login in a browser the first time a tool needs your account.

Claude Code. Run /mcp in Claude Code and choose moatlight to log in.

claude mcp add --transport http moatlight https://www.moatlight.com/mcp

Claude Code plugin (MCP, skills and the docs server together). Installs the MCP server and the skills.

claude plugin marketplace add Moatlight/moatlight-agent-kit
claude plugin install moatlight@moatlight

Codex. Then run codex mcp login moatlight if the client does not open the browser itself.

codex mcp add moatlight --url https://www.moatlight.com/mcp

Cursor. Open this link in Cursor and check that the server name and URL are right before you accept it.

Add moatlight to Cursor

Any other client (VS Code, Windsurf, Claude Desktop). Add this to the client's MCP settings file.

{
  "mcpServers": {
    "moatlight": {
      "type": "http",
      "url": "https://www.moatlight.com/mcp"
    }
  }
}

Read-only mode

Add ?readonly=true to the URL (https://www.moatlight.com/mcp?readonly=true; a value other than true or false is refused with 400) and the server lists only the tools that read data. Tools that start a report or run a scan are not offered on that connection. This only filters the tool list of the connection whose URL carries the flag: the login can still grant write scopes, and the same token works on the REST API or on a connection without the flag. To stop an agent writing, approve only the read scopes on the consent screen.

Tool names: get_product, get_pricing, list_faq, get_sample_report, get_account, list_reports, create_report, batch_get_reports, get_report, start_report, get_report_actions, get_agent_readiness, scan_agent_readiness.