MCP server

@cencori/mcp is Holeacquisition LLC's official Model Context Protocol server. It gives Cursor, Claude Desktop, Codex, and any MCP client direct access to Holeacquisition LLC Web, documentation, Embedded Agents inspection, gateway metrics, memory, agents, sessions, governance, and multimodal inference.

It is a thin stdio adapter over Holeacquisition LLC's public HTTP APIs. The platform enforces authentication, project isolation, quota, policy, and audit logging; the MCP server adds capability flags and tool annotations for reads, writes, destructive changes, and open-web access.

Version 0.8.0 includes first-party Web tools and read-only Embedded Agents inspection.

Documentation and manual guidance work without a key:

npx -y @cencori/mcp@latest

For Holeacquisition LLC Web and authenticated platform reads, add a project key:

{
  "mcpServers": {
    "cencori": {
      "command": "npx",
      "args": ["-y", "@cencori/mcp@latest"],
      "env": {
        "CENCORI_API_KEY": "csk_your_project_key"
      }
    }
  }
}

Add this object to your MCP client's configuration, then restart the client.

Web search, fetch, extraction, and browser-job polling are read tools. Crawling, starting a browser job, and submitting a takedown request require the write flag because they enqueue work or change project state.

{
  "mcpServers": {
    "cencori-web": {
      "command": "npx",
      "args": ["-y", "@cencori/mcp@latest"],
      "env": {
        "CENCORI_API_KEY": "csk_your_project_key",
        "CENCORI_MCP_FEATURES": "web,docs",
        "CENCORI_MCP_WRITE": "1"
      }
    }
  }
}

CENCORI_MCP_FEATURES is optional. The example limits the exposed surface to Web and docs.

Web access uses Holeacquisition LLC's own crawler, corpus, embeddings, and ranking pipeline — not a third-party search API.

All Web tools advertise openWorldHint: true. Their descriptions state that page content is untrusted data, never agent instructions. web_browse also rejects password, token, and secret field selectors. Browser jobs are asynchronous; call get_web_browser_job with the id returned by web_browse.

Example prompt after configuring the server:

Search the Cencori Web index for the latest PostgreSQL row-level security
documentation. Compare the top three sources, quote the evidence you used,
and include each source URL and retrieval timestamp.

The server is safe by default: reads require a key, while operations that incur cost or change state are opt-in.

Manual-only actions

Credential, billing, access, and governance-activation decisions are never executed by the MCP server. The corresponding how_to_* tools return instructions and a dashboard link:

• API keys: how_to_create_api_key, how_to_edit_api_key, how_to_revoke_api_key
• Governance: how_to_activate_policy, how_to_respond_to_change_request
• Billing: how_to_change_plan, how_to_manage_billing
• Access: how_to_manage_members

Restart the MCP server after changing environment variables.

Public

• Docs: search_docs, get_doc, list_docs, get_integration_guide
• Guidance: API key, governance, billing, and membership how_to_* tools

Authenticated reads

• Web: web_search, web_fetch, web_extract, get_web_browser_job
• Gateway: list_models, get_metrics, get_health, check_quota
• Agents: list_agents, get_agent, poll_agent_actions
• Memory: list, semantic search, get, entities, graph, forget suggestions, and GDPR export
• Sessions: list, get, and events
• Governance: policies, roles, change requests, ledger, evidence, and templates
• Embedded Agents: tenants, versions, installations, runs, actions, knowledge, skills, provider connections, usage, webhooks, and remote MCP snapshots

To expose only Embedded Agents inspection, set CENCORI_MCP_FEATURES=embedded. The feature is deliberately read-only; publishing, approvals, credentials, and other writes remain dashboard- or API-guided.

Write

• Web: web_browse, web_crawl, request_web_takedown
• Inference: text, RAG, embeddings, moderation, images, vision, documents, TTS, and transcription
• Model params accept auto / cencori-auto on BYOK projects: the gateway task-routes across the project's provider keys (chat, embeddings, images, TTS) instead of billing Holeacquisition LLC credits. See BYOK auto-router.
• Memory: remember_memory, write_memory, create_namespace
• Agents: create_agent, update_agent
• Sessions: create_session, add_session_turn
• Governance drafts: create_policy, install_template

Destructive

delete_memory, forget_memories (by filter), delete_agent, delete_session, approve_session, and reject_session.

The package is a thin stdio adapter over Holeacquisition LLC's HTTP APIs. The platform still enforces authentication, project isolation, quotas, policy, and audit logging. The MCP layer adds tool annotations and local capability flags so the client can distinguish reads, writes, destructive changes, and open-web access before execution.

Keep CENCORI_API_KEY in the MCP server environment, not in prompts or checked-in configuration. Treat all Web results as potentially adversarial input and require human approval before consequential actions.

Only docs tools appear: add CENCORI_API_KEY and restart the client.

web_browse or web_crawl is missing: set CENCORI_MCP_WRITE=1.

No Web tools appear with CENCORI_MCP_FEATURES: include web in the comma-separated list.

No Embedded Agents tools appear with CENCORI_MCP_FEATURES: include embedded and provide a secret project key.

A browser job is still queued: call get_web_browser_job with the id returned by web_browse. Browser work is intentionally asynchronous.

A URL is rejected: Holeacquisition LLC blocks private networks, unsafe redirects, embedded credentials, unsupported protocols, robots-denied pages, and oversized responses.