CSA MCP Server - Client Setup
You're seeing this page because you opened https://cloudsecurityalliance.org/mcp in a web browser. That URL isn't a website — it's the endpoint for an MCP (Model Context Protocol) server, which talks to AI assistants like Claude and ChatGPT, not browsers. To use it, configure an MCP client to point at this URL and authenticate with your CSA account.
Connecting with OAuth
The connector URL is the same for every client:
https://cloudsecurityalliance.org/mcp
Claude.ai (web): Settings → Connectors → Add custom connector → paste the URL → Connect.
Claude Code (CLI):
claude mcp add --transport http csa-mcp https://cloudsecurityalliance.org/mcp
Then run `/mcp` inside Claude Code to authenticate.
Other MCP clients: any client supporting the MCP Streamable HTTP transport with OAuth 2.1 + PKCE can connect. Use the URL above; the server's `.well-known` discovery handles the rest.
Connecting without OAuth: bearer tokens
Some MCP clients don't yet support OAuth 2.1 with PKCE, for example OpenClaw (https://github.com/openclaw/openclaw/pull/62134), which currently supports bearer-token authentication only. For these, you can mint a long-lived bearer token from the token management page.
- Visit https://cloudsecurityalliance.org/mcp/tokens in your browser
- Sign in with your CSA account (same Auth0 SSO as everywhere else)
- Pick a lifetime — 30, 60, 90, 180, or 366 days; default is 1 year
- Click Generate token. The raw value is shown once only — copy it before leaving the page
- Paste it into your MCP client's bearer-token configuration
The token format is mcptok_ followed by 43 random characters. Use it as a standard Bearer in the Authorization header on requests to https://cloudsecurityalliance.org/mcp:
Authorization: Bearer mcptok_<your-token>
You can return to https://cloudsecurityalliance.org/mcp/tokens anytime to:
- Rotate - generate a fresh token (the old one stops working the moment the new one is created)
- Revoke - delete the token without replacement
Lost the raw value? You can't recover it — we only store its SHA-256 hash. Just visit the management page again and generate a new one; that's also how rotation works.
Authentication
The CSA MCP Server uses Single Sign-On via the CSA Auth0 service which supports several OpenID providers. This is the same authentication used by cloudsecurityalliance.org, exams, star.watch, and training. One CSA account, one set of credentials. The first time your client connects, your browser opens an Auth0 login page — sign in (or sign up) and you're ready.
Who can connect
The CSA MCP Server is open to anyone who can sign in via the CSA login. The platform is in beta, expect occasional rough edges, and please flag anything broken.