# SecurityTrackr agent access

SecurityTrackr is a security observation and governance register. Agents can
work with an organisation's observations, but programmatic access requires an
eligible paid plan and explicit human setup.

## Important rules

- SecurityTrackr does not support unattended account creation by an agent.
- A human must complete account creation, email verification, MFA enrolment,
  plan upgrade, and agent authorisation.
- The agent must not request or retain the user's password, mailbox access,
  email-verification code, TOTP secret, passkey, backup codes, or browser
  session cookie.
- A new account receives owner permissions for the organisation it creates.
  Creating that account does not by itself enable agent access.
- Agent access is unavailable on the Free plan. Upgrade the organisation to an
  eligible paid plan before connecting an agent or creating an API token.

## New account setup

Use this flow when the user does not yet have a SecurityTrackr account:

1. Open `https://app.securitytrackr.com/auth/register`.
2. Enter the user's name, organisation name, work email, password, and terms
   acceptance. Complete the Cloudflare Turnstile challenge in the browser.
3. SecurityTrackr sends a six-digit verification code to the email address.
   The user must open their mailbox and paste that code into the application;
   the email does not contain a link.
4. Choose an authenticator app or a passkey, and save the backup codes.
5. Sign in with the new account. The new account has owner permissions for the
   organisation it created.
6. Upgrade the organisation to an eligible paid plan from Account / Subscription.
7. After the paid plan is active, choose one of the integration methods below.

The agent may guide the user through these steps and ask the user to paste the
verification code, but it must not read the mailbox or handle the MFA secret.

## Existing account setup

Use this flow when the user already has a SecurityTrackr account:

1. Open `https://app.securitytrackr.com/auth/signin`.
2. Sign in in the browser. The user completes Turnstile and proves MFA with an
   authenticator code, backup code, or passkey. If the organisation requires
   SSO, follow the organisation's SSO sign-in flow instead.
3. Confirm that the organisation has an eligible paid plan. If not, upgrade it
   from Account / Subscription.
4. After the paid plan is active, choose one of the integration methods below.

## Preferred integration: MCP over OAuth

Use MCP for interactive AI agents. Add this remote MCP server to the user's
MCP-compatible agent:

`https://app.securitytrackr.com/api/mcp`

The MCP client should follow SecurityTrackr's OAuth discovery and open the
SecurityTrackr authorisation page in a browser. The user signs in, reviews the
requested permissions, and explicitly approves the connection. Do not ask the
user to copy an API token for this flow.

MCP accepts OAuth access tokens only. The resulting access is scoped to the
user's role and the permissions approved on the consent screen. Calls are
attributed to the consenting user, access expires after the grant lifetime, and
the user can disconnect the agent from Account / Connected agents.

OAuth discovery metadata:

- Protected-resource metadata:
  `https://app.securitytrackr.com/.well-known/oauth-protected-resource/api/mcp`
- Authorisation-server metadata:
  `https://app.securitytrackr.com/.well-known/oauth-authorization-server`

## REST fallback: bearer token and OpenAPI

Use the REST API for scanners, CI, SIEM connectors, and integrations that do
not support MCP. A user with owner permissions creates a token from Account /
API Tokens after completing MFA step-up. The token is displayed once; store it
in the integration's secret store and never put it in source control, prompts,
chat transcripts, or URLs.

OpenAPI specification:

`https://app.securitytrackr.com/api/v1/openapi.json`

Send the token on every request over HTTPS:

```http
Authorization: Bearer sgt_live_<keyId>_<secret>
```

API tokens are role-scoped and never receive owner-level authority. They are
the legacy integration path; MCP over OAuth is the preferred connection for
AI agents.

## Revocation and safety

The user can disconnect OAuth agents from Account / Connected agents and revoke
API tokens from Account / API Tokens. If a credential may have been exposed,
revoke it immediately and create a replacement only after reviewing the
integration's secret handling.

Useful documentation:

- MCP connection guide: `https://securitytrackr.com/learn/connecting-agents-over-mcp`
- REST/API guide: `https://securitytrackr.com/learn/api-built-for-agents`
- Terms: `https://app.securitytrackr.com/terms`
- Privacy: `https://app.securitytrackr.com/privacy`
- Support: `mailto:support@securitytrackr.com`