Setup & Connection

Connect ByteHide Radar to your AI coding agent in minutes. The MCP server uses a streamable HTTP transport with OAuth authentication — no API keys to manage manually.

Connection URL

All MCP clients connect to the same endpoint:

https://mcp.bytehide.com/mcp

https://mcp.bytehide.com/mcp

Transport type: Streamable HTTP (POST requests only).

Claude Desktop & Claude.ai

The easiest way to connect. ByteHide is listed in the Anthropic MCP directory.

1. Open Claude Desktop or go to claude.ai
2. Navigate to Settings > MCP Servers (or find ByteHide in the MCP integrations directory)
3. Search for ByteHide and click Connect
4. A browser window opens — log in with your ByteHide account
5. Authorize the connection and return to Claude

Once connected, Claude can use all ByteHide Radar tools automatically. Try asking: "Scan this file for security vulnerabilities" or "Is the lodash package safe to install?"

Claude Code (CLI)

Add the ByteHide MCP server with a single command:

claude mcp add bytehide --transport streamable-http https://mcp.bytehide.com/mcp

claude mcp add bytehide --transport streamable-http https://mcp.bytehide.com/mcp

The next time Claude Code needs to use a ByteHide tool, it will prompt you to authenticate via your browser.

To verify the connection:

claude mcp list

claude mcp list

You should see bytehide listed with the streamable-http transport.

Cursor

Add ByteHide to your Cursor MCP configuration:

1. Open Cursor and go to Settings > MCP
2. Click Add new MCP server
3. Use the following configuration:

{
  "mcpServers": {
    "bytehide": {
      "type": "streamable-http",
      "url": "https://mcp.bytehide.com/mcp"
    }
  }
}

{
  "mcpServers": {
    "bytehide": {
      "type": "streamable-http",
      "url": "https://mcp.bytehide.com/mcp"
    }
  }
}

4. Save and restart Cursor
5. The first time a ByteHide tool is invoked, a browser window will open for authentication

VS Code (Copilot / MCP Extensions)

For VS Code with MCP support, add the server to your MCP settings file:

1. Open or create .vscode/mcp.json in your project root (or your global MCP configuration)
2. Add the ByteHide server:

{
  "mcpServers": {
    "bytehide": {
      "type": "streamable-http",
      "url": "https://mcp.bytehide.com/mcp"
    }
  }
}

{
  "mcpServers": {
    "bytehide": {
      "type": "streamable-http",
      "url": "https://mcp.bytehide.com/mcp"
    }
  }
}

3. Reload the window
4. Authenticate when prompted on first use

Other MCP Clients

Any client that supports the streamable-http transport can connect to ByteHide. The universal configuration is:

{
  "mcpServers": {
    "bytehide": {
      "type": "streamable-http",
      "url": "https://mcp.bytehide.com/mcp"
    }
  }
}

{
  "mcpServers": {
    "bytehide": {
      "type": "streamable-http",
      "url": "https://mcp.bytehide.com/mcp"
    }
  }
}

If your MCP client requires specifying the transport separately, use:

Authentication

ByteHide MCP uses OAuth 2.1 with PKCE for secure authentication. You don't need to create API keys or manage tokens — the flow is handled automatically by your MCP client.

How it works

1. Your AI agent sends a request to the MCP server
2. The server responds with an authentication challenge
3. Your MCP client opens a browser window to the ByteHide login page
4. You log in with your ByteHide account and authorize the connection
5. The client receives a secure token and stores it locally
6. All subsequent requests are authenticated automatically

Token refresh

Access tokens are short-lived and refreshed automatically by your MCP client using a refresh token. You should not need to re-authenticate unless you revoke access or your session expires after an extended period.

Scopes

The OAuth token includes scopes that determine which tools you can use:

Verifying the Connection

After setup, test that everything works by asking your AI agent:

• "List my ByteHide projects" — should return your organization's projects
• "Check if express@4.17.1 is safe" — should check the package against known CVEs
• "Scan this file for vulnerabilities" — should run a SAST scan on the current file

If any of these fail, check that:

1. You completed the OAuth authentication in your browser
2. Your ByteHide account has access to at least one organization
3. Your MCP client is configured with the correct URL (https://mcp.bytehide.com/mcp)

Troubleshooting

"Authentication required" on every request

Your MCP client may not be storing the OAuth token correctly. Try removing and re-adding the server:

# Claude Code
claude mcp remove bytehide
claude mcp add bytehide --transport streamable-http https://mcp.bytehide.com/mcp

# Claude Code
claude mcp remove bytehide
claude mcp add bytehide --transport streamable-http https://mcp.bytehide.com/mcp

For other clients, remove the ByteHide entry from your MCP configuration, restart the client, and add it again.

"Unauthorized" or "Invalid token"

Your token may have expired. Trigger a new authentication by invoking any ByteHide tool — your MCP client should automatically open the login flow again.

Tools not appearing

Make sure the server is listed as connected in your MCP client settings. Some clients require a restart after adding a new server.

Next Steps