Connect an AI agent to AdminKit's MCP server

Two ways to use AdminKit’s MCP server today

AdminKit’s MCP server overview lists the 8 planned tools and is honest that the hosted endpoint at adminkit.net/mcp is not live yet. What that page doesn’t dwell on is that the server behind it is open source (MIT) and already runs, self-hosted, from the mcp/ directory — this guide covers the self-hosting path and exactly which tools return real results versus an honest “not available yet” today.

Install and run it

# from a checkout of the AdminKit repository
pip install ./mcp

# stdio transport (default) — what a locally-spawned client like Claude Desktop expects
adminkit-mcp

# or streamable HTTP, for a remote/network client
adminkit-mcp --http :8080

adminkit-mcp is not published to PyPI, npm, Docker Hub or an MCP registry yet, so install it from a local checkout rather than a package index. Point your MCP client’s server config at the adminkit-mcp executable (stdio) or http://localhost:8080 (HTTP), the same as any other local MCP server.

Configuration (environment variables)

Variable	Default	Purpose
ADMINKIT_API_BASE	https://api.adminkit.net	Check API base URL (not reachable yet — see below).
ADMINKIT_SITE_BASE	https://adminkit.net	Interim fallback base for the three tools that have one.
ADMINKIT_API_KEY	unset	Optional API key, attached as X-API-Key; never logged.
ADMINKIT_MCP_TIMEOUT_SECONDS	10.0	HTTP timeout for both backends.
ADMINKIT_MCP_RATE_LIMIT_PER_SECOND	5.0	Client-side rate limit applied to outbound calls.
ADMINKIT_MCP_ALLOW_PRIVATE	false	Allow check_mcp_endpoint to probe loopback/private targets (CI use only).

Which of the 8 tools actually return real data today

Every tool first tries the real Check API (/v1/check/...) and gets a 404/501 back, since the Check API itself is not deployed anywhere reachable yet (see the OpenAPI reference). What happens next differs by tool:

Tool	Behaviour today
check_mcp_endpoint	Works fully. A local, self-contained probe — never calls the Check API at all.
check_ip	Works via interim fallback to AdminKit’s live site function (adminkit.net/api/ip) once the Check API returns 404/501.
check_mail_auth	Works via interim fallback to the live site’s SPF/DMARC function (adminkit.net/api/mailauth), same mechanism as check_ip.
check_domain	Returns a structured “not available” result — there is no interim fallback for the whois/TLS/HTTP sub-checks it aggregates.
check_owned_ports	Returns “not available yet” — this is an ownership-gated endpoint that only exists on the Check API.
explain_report	Returns “not available yet” — depends on the Check API’s saved-report storage.
get_radar	Returns “not available yet” — depends on AdminKit Radar’s aggregated telemetry endpoint.

None of the “not available” responses fabricate a result — each returns the same envelope shape (result, evidence, fix_hint, report_url) with a plain message saying what isn’t live yet and a link to the matching public page, so an agent calling the tool gets a clear, structured answer either way.

One-shot probe, no server required

If you only need the endpoint-exposure check — the same one the GitHub Action runs in CI — you don’t need to run a server at all:

adminkit-mcp probe https://mcp.example.com/mcp

This prints the same JSON result (url, status, score, findings, evidence) the check_mcp_endpoint tool returns, and is exactly what the GitHub Action calls under the hood.

Why this matters for agent builders

If you’re building an agent that needs to check its own exposure, or a user’s, before acting — whether an MCP endpoint is safe to call, whether a domain’s mail setup looks wrong, what a caller’s own IP looks like — self-hosting today means you don’t have to wait for the hosted endpoint or the Check API to ship to start integrating. Three of eight tools are fully functional now, and the rest fail honestly instead of silently returning nothing or guessing. See our AI agent builders solutions page and the MCP endpoint check tool page for the fuller picture, and our guide to securing an MCP server if you’re the one building the server an agent like this would call.

Where AdminKit fits

The planned MCP & Agent Gateway is a different, complementary piece: it sits in front of your MCP server to enforce auth and tool allowlists, rather than being a set of tools an agent calls outward. Self-hosting adminkit-mcp today gives an agent the outward-facing check tools; the gateway, once live, protects the inward-facing server side.