Agency Checkby Cyber Strategy Institute

Connect

Use the same address in every client that can add a remote MCP server.

MCP address: https://agency-check.app/mcp

What happens

  1. The client calls that address.
  2. Agency Check answers with a sign-in challenge. The protocol is OAuth 2.1 with PKCE (S256).
  3. You see a consent page. You can turn off permissions you do not want.
  4. Sign-in on this server uses Google. Google sign-in is open. A Google account on the operator list is Comp (team).
  5. After that, the client can ask for a Decision Card.

Claude

In Claude, add a custom connector and paste the MCP address. The menu names in Claude change. The address does not. This server does not ship a separate Claude plugin.

ChatGPT

Use the same MCP address in a ChatGPT client that adds a remote MCP server with OAuth. This server does not ship a separate ChatGPT plugin, and the menu name in ChatGPT can change.

Grok

Use the same MCP address in a Grok client that adds a remote MCP server with OAuth. This server does not ship a separate Grok plugin.

Any other MCP client

Any client that speaks remote MCP over HTTP and OAuth 2.1 with PKCE (S256) can use the address above. Client ID Metadata Documents are preferred. Dynamic client registration is also available.

Protocol versions this server accepts: 2026-07-28, 2025-11-25, 2025-06-18, and 2025-03-26.

Permissions are agency.check (Decision Cards), agency.receipts (your own receipts), and agency.data (your account).

A platform review can use a demo sign-in that the operator turns on. It is one shared identity, not a private account, so people using it share its checks. It is off unless enabled. See Security. It is separate from the sign-in above. A real account cannot read another person's checks.