DecryptAds MCP

Endpoint

Use this URL in your MCP client (remote / HTTP transport):

https://mcp.decryptads.com/mcp

Transport path is /mcp, not the site root. Backend: same REST API as api.decryptads.com/docs.

API key (required)

MCP is available to signed-in DecryptAds accounts (free, researcher, and enterprise). Each user connects with their own API key (same tokens as the REST API). Some tools still require researcher / enterprise (e.g. Legal dossier, Crawl, Auto-Investigate, Feed Builder). Per-host ad-density and privacy scores are available to all signed-in tiers, including free.

1. Sign in at decryptads.com.
2. Open Account → API keys and create a token.
3. Copy the key when shown (svw_…); it is displayed only once.
4. Add it to your MCP client (see below).

Send the token on every MCP request using either header (same key value):

Authorization: Bearer svw_YOUR_KEY_HERE

# or

X-API-Key: svw_YOUR_KEY_HERE

Prefer Authorization: Bearer … when the client has a standard OAuth/Bearer field. Use X-API-Key if your client only supports custom headers or you already use that style for REST. Do not send both with different values.

The bridge validates the key, then forwards it to the API (rate limits and monthly quota apply per user). Revoke the key in the app to disable MCP immediately.

See also: How to use the API.

Agent usage rules (read this)

These rules are also published as MCP server instructions to connected clients. AI agents and operators must follow them to avoid overloading database-backed endpoints (especially validation alerts) and hitting rate / monthly quota limits.

1. One publisher at a time. Load investigation data for a single hostname, finish that analysis, then move to the next. Do not open many publishers in parallel.
2. No fan-out. Do not call publisher_* tools across a long list of hosts concurrently — especially publisher_validation_alerts, publisher_autoinvestigate, and publisher_jurisdiction_partners.
3. Prefer Auto-Investigate first (researcher+). Use publisher_autoinvestigate once per host for the scored overview when the key has researcher or enterprise access (free-tier keys get 403 on Auto-Investigate). For the full ad-density and privacy crawl envelopes on that same host, call publisher_ad_density_score and publisher_privacy_score (available to all signed-in tiers, including free). Call publisher_validation_alerts or publisher_jurisdiction_partners when you need those payloads for the same host (available to all tiers, including free).
4. Be sparse with crawls. ingest_hostnames triggers live fetches; use it only when the user asks to rescan, and keep batches small.
5. Prefer specifics over corpus sweeps. Query named hostnames / ad systems the user cares about rather than bulk directory dumps unless explicitly requested.
6. Legal dossier is heavy. Call legal_dossier one query at a time. Prefer a hostname, ads ID (pub-… / seller id), or registry/tax ID over vague name sweeps. Requires a researcher or enterprise account.
7. Projects are private to the API-key owner. Tools like list_projects, get_project, and pin_to_project read/write the same Projects as the webapp UI for that user. There is no shared/team project store. Legacy aliases (list_cases, pin_to_case, …) still work.
8. Feed Builder is researcher+. Tools like list_feeds, preview_feed, and create_feed require the feed_builder feature. Free-tier keys get 403.
9. Rate limits. No more than 1 request per second and 30 requests per minute for heavy tools (sellers_json domain lookup, declared_supply, reverse_owner / reverse_manager, Auto-Investigate, validation alerts). Investigate one hostname at a time. Shared monthly quota still applies. Bursting or parallel host lists will return 429. MCP uses the same API key as REST; session webapp traffic is not on this 30/min cap.

Full tool list below. Canonical page for agents: this document at https://mcp.decryptads.com/.

Client setup

Cursor

Edit ~/.cursor/mcp.json or a project .cursor/mcp.json. Bearer (recommended):

{
  "mcpServers": {
    "decryptads": {
      "url": "https://mcp.decryptads.com/mcp",
      "headers": {
        "Authorization": "Bearer svw_YOUR_KEY_HERE"
      }
    }
  }
}

Same key via X-API-Key:

{
  "mcpServers": {
    "decryptads": {
      "url": "https://mcp.decryptads.com/mcp",
      "headers": {
        "X-API-Key": "svw_YOUR_KEY_HERE"
      }
    }
  }
}

Restart Cursor (or reload MCP). Tools appear in the MCP panel after a successful connection.

Claude Desktop

Same url and headers block (Bearer or X-API-Key) in claude_desktop_config.json under mcpServers. Restart the app fully.

Claude Code

claude mcp add --transport http decryptads https://mcp.decryptads.com/mcp \
  --header "Authorization: Bearer svw_YOUR_KEY_HERE"

# or

claude mcp add --transport http decryptads https://mcp.decryptads.com/mcp \
  --header "X-API-Key: svw_YOUR_KEY_HERE"

More clients and examples: Using DecryptAds with MCP (blog).

Tools

After you connect with a valid API key, your MCP client lists tools from the server (tools/list). Names and descriptions match the deployed bridge. Tools are grouped like the app: publisher page, ad system page, then shared utilities.

Large impression-log uploads are not exposed via MCP; use the web UI, then poll with get_impressionlog_analysis_job.

Example prompts

• “Investigate risk for example.com” → publisher_autoinvestigate (one host; researcher+)
• “Ad-density and privacy lab scores for example.com” → publisher_ad_density_score then publisher_privacy_score (same host; signed-in including free)
• “Legal identity dossier for this company / domain / ads ID” → legal_dossier (one query; researcher+)
• “Show my projects” → list_projects
• “Status of project Northwind” / “what’s pinned in project 12” → get_project
• “Pin publisher/example.com to project 12” → pin_to_project
• “Preview a hostname feed of ads.txt sha256 abc…” → preview_feed (researcher+)
• “Summarize declared supply for this publisher” → publisher_declared_supply
• “Show DNS / RDAP for example.com” → ns_rdap
• “Which corpus domains share example.com’s nameservers?” → ns_peers
• “Show the TLS certificate for example.com” → hostname_tls
• “Which hostnames present the same leaf cert as example.com?” → tls_peers
• “Show validation alerts for this publisher only” → publisher_validation_alerts
• “List geo-risk / high-risk ad systems” → get_ad_systems_high_risk (GET /stats/ad_systems_high_risk)
• “Search data-broker filings for biometric / location data” → search_data_broker_registry
• “Which ad systems match CA/TX/VT/OR broker registries?” → get_ad_systems_data_broker
• “Oregon data-broker match for this publisher” → publisher_oregon_data_broker_match
• “Show PubMatic sellers.json diff” → ad_system_sellers_diff
• “Which sites declare this ad system?” → ad_system_list_declaring_sites
• “Validate this schain JSON against ads.txt” → validate_schain_json
• “Rescan these hostnames” → ingest_hostnames (small batches)

Avoid prompts that imply parallel multi-host investigation (“check validation alerts for these 50 domains at once”).

More documentation

• Using DecryptAds with MCP — Cursor, Claude, ChatGPT
• How to use the API — keys, curl, Postman
• REST API (OpenAPI / Swagger) — routes behind the tools
• DecryptAds app

MCP and REST share the same API keys and backend. For scripts without an AI assistant, call the REST API directly.