Connect an AI assistant

WebDecoy runs a hosted MCP server at https://mcp.webdecoy.com/mcp. Connect your AI assistant to it and you can ask it to install WebDecoy in the app you are working on, check the install is reporting, and answer questions about your sites: whether protection is actually enforced, which bots were seen, and what an actor did.

You choose what each assistant sees. The first time an assistant asks for data, it gives you an approval link. Open it, tick the sites that assistant may read, and approve. Review or disconnect an assistant any time in Settings, Connected apps.

Claude Code

Install the WebDecoy plugin:

/plugin marketplace add WebDecoy/claude-plugins
/plugin install webdecoy@webdecoy

Restart Claude Code, run /mcp and sign in to webdecoy. Then ask it to “install WebDecoy in this app”, or run /webdecoy:install. The plugin adds the MCP server, an install skill that follows WebDecoy’s own guide for your stack, and the /webdecoy:install command. Source: WebDecoy/claude-plugins.

Claude.ai and Claude Desktop

In Settings, Connectors, choose Add custom connector and enter:

https://mcp.webdecoy.com/mcp

Claude opens WebDecoy’s sign-in. After you sign in, ask Claude about your sites.

Codex

codex mcp add webdecoy --url https://mcp.webdecoy.com/mcp
codex mcp login webdecoy --scopes mcp:read,mcp:setup,offline_access

ChatGPT

In Settings, Apps and Connectors, turn on developer mode and choose Create. Enter https://mcp.webdecoy.com/mcp as the server URL with OAuth authentication, and under the advanced OAuth settings choose dynamic client registration.

What the assistant can do

Tool	What it does
list_properties	The sites you approved for this assistant
get_protection_status	Whether a site is actually protected, and why not
search_detections	Bot detections on a site, filterable by time and score
get_actor_evidence	What one actor did across a site
get_current_policy	What the site’s policy is configured to do
get_install_guide	Install steps for your stack, with your public IDs filled in
get_install_status	Whether the install is reporting, plus a test request to prove it
create_script_tag	Create a site’s detection script (needs setup permission)
verify_install	Check one of your own pages serves the WebDecoy tag (needs setup permission)

What it cannot do

• It reads by default. The two setup tools work only if you tick Also allow setup when you approve the assistant.
• It never changes your policies, enforcement, settings or billing. Those stay in the dashboard.
• It never receives secret keys. Install guides name the environment variables your app needs, and you set their values yourself.

Data an assistant reads is sent to that assistant’s provider. See section 4.5 of the privacy policy.