MCP server reference

Overview

The Ironfang MCP server is a remote Model Context Protocol server. One endpoint serves every Ironfang product:

https://mcp.ironfang.uk/mcp

MCP is not a separate product and has no separate price. It is another safe way to use Renderwolf: rendering spends ordinary Renderwolf credits, reads are free, and each connection has its own spending budget (see credits and budgets).

Tested clients

A client needs remote OAuth support - either a Client ID Metadata Document (CIMD) or public-client Dynamic Client Registration - to connect. We test with real clients and record the date and version; "expected" means the flow is standard but we have not run it ourselves yet.

Claude Code

claude mcp add --transport http ironfang https://mcp.ironfang.uk/mcp

Then inside Claude Code run /mcp, pick ironfang and choose Authenticate. A browser tab opens at id.ironfang.uk: sign in, pick the organisation this connection acts for, review the scopes and allow. The tab closes and the tools appear.

Claude Desktop and claude.ai

Settings → Connectors → Add custom connector, name it Ironfang and enter https://mcp.ironfang.uk/mcp. The same sign-in follows. Please tell us the date and app version when it works for you and we will add it to the table.

Never paste an API key into a chat. The MCP server does not accept Ironfang API keys as a credential; keys stay with the REST API where they belong.

Authentication

The server is an OAuth 2.1 protected resource. An unauthenticated request answers 401 with a WWW-Authenticate challenge that points at the resource metadata document; from there a client discovers the authorization server and completes the code flow with PKCE (S256). The flow, from the client's side:

1. Read https://mcp.ironfang.uk/.well-known/oauth-protected-resource/mcp.
2. Read https://id.ironfang.uk/.well-known/oauth-authorization-server.
3. Identify itself: by a Client ID Metadata Document (an HTTPS URL as the client id, preferred), or by registering as a public client at /oauth/register.
4. Send the person to /oauth/authorize with resource=https://mcp.ironfang.uk/mcp, the scopes it wants and a PKCE challenge.
5. The person signs in, chooses one organisation and consents. A connection is one person, one organisation, one client.
6. Exchange the code at /oauth/token. The access token is short-lived and addressed only to the MCP resource; a rotating refresh token keeps the connection alive without asking again.

Scopes

Scopes are the product's own. A scope is granted only if the person holds the matching permission in the organisation they chose, and it is checked again live on every call - losing a permission ends the access the same minute.

A tool whose scope was not granted is still listed, so a client can ask for it: the call answers 403 with the complete scope set in the challenge and the client runs the flow again for the extra scope.

What the server does with the token

Nothing leaves the MCP server carrying your MCP token. To call a product it asks id.ironfang.uk for a separate two-minute token addressed to that product, limited to the scopes you granted and to the organisation you chose, and marked as acting on your behalf. Products refuse an MCP token outright, and the MCP server refuses portal or product tokens.

Revoking

Disconnect a client from the portal's AI clients page or from your account settings at id.ironfang.uk. Revocation ends the refresh token family and the connection; a live access token stops working within thirty seconds, not at its expiry.

Renderwolf tools

Tool inputs are strict JSON Schema objects: unknown fields are rejected rather than ignored, and every string, size and duration is bounded. Rendering tools take a public URL or bounded raw HTML. They do not accept cookies, authorization headers, custom request headers, proxy settings, scripts to execute, or private network targets.

Cached repeats are free, exactly as on the REST API, and free-plan output branding is the same whichever way you render. Every tool carries hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) and namespaced metadata naming its scope, product, credit behaviour and risk, so a client can show a person what a call will do before it does it.

Jobs, tasks and results

Every creation tool queues a durable Renderwolf job and answers at once with the same envelope, so a retry or a dropped connection never loses or duplicates work:

{
  "request_id": "01a0…",
  "job_id": "01a0…",
  "status": "queued",
  "product": "renderwolf",
  "kind": "screenshot",
  "cached": false,
  "credits": { "reserved": 1, "charged": 0 },
  "result": null,
  "created_at": "2026-08-27T23:09:45Z",
  "connection_id": "01a0…"
}

Poll renderwolf.job.get (or read the job resource). Once status is succeeded, result holds the media type, byte size, SHA-256, the moment the hosted result expires, and a download link:

• Hosted results are kept for 24 hours after success.
• Download links are signed and valid for 15 minutes; every read of the job or its result resource issues a fresh one.
• Links are the default even for screenshots. PDFs, clips and full-page images are never returned inline; a screenshot under 2 MiB can be, only when a client asks for it explicitly.
• For longer retention, download the result or use a Renderwolf job delivery destination when that ships.

Clients on revision 2026-07-28 that advertise the io.modelcontextprotocol/tasks extension receive a task handle for screenshot, PDF and template work and must use one for clips; tasks/get mirrors the job's state and tasks/cancel is a cooperative cancel. Other clients get the envelope above and poll. Both roads end at the identical terminal result.

Resources

Read-only metadata is also exposed as resource templates, for clients that prefer to attach context rather than call tools. There is no enumeration of your objects; ids come from tool results.

Credits and budgets

There is no MCP fee. Connecting, listing tools, reading usage and reading metadata are free. Rendering spends ordinary Renderwolf credits at the ordinary rate, and failed or cancelled work follows the same refund rules as the REST API.

On top of the plan's cap, every connection has its own budget so a looping agent cannot spend a month's allowance in an afternoon:

connection budget = max(25, 10% of the plan's monthly credits)
                    capped by the organisation's remaining allowance
                    per billing period

Before chargeable work the server reserves the tool's maximum cost against the budget, then settles to what the product actually charged and releases the rest; ironfang.connection.get shows the allowance, what is reserved, what has been settled, what remains and when it resets. An exhausted budget answers mcp_budget_exhausted with the reset time; the plan cap answers the product's usual quota_exceeded.

Auditwolf tools

Not yet available. Auditwolf tools (list sites, start a bounded audit, read audits, findings and evidence links) follow the Auditwolf commercial release. They will reuse the auditwolf:* scopes and never expose integration secrets, rule editing, schedules or retention controls to a model.

Security

• The MCP access token is addressed to https://mcp.ironfang.uk/mcp and nowhere else; products reject it, and the MCP server rejects tokens meant for the portal or a product.
• Product calls use a separate two-minute token minted per call, limited to your granted scopes and your chosen organisation, and never a stored key.
• Scopes are re-checked against your live organisation permissions on every call, and the connection's grant status with a fail-closed cache of at most thirty seconds.
• Client identity is a Client ID Metadata Document fetched over HTTPS with private-network, redirect and size protections, or a rate-limited public-client registration that is retired after thirty days unused. Registrations cannot choose their own scopes.
• Rendering tools refuse cookies, authorization and custom headers, proxies, script execution and private-network targets. Raw HTML is bounded and never logged.
• Signed download links expire in fifteen minutes and are bound to the job's organisation.
• There is no tool that mints keys, manages members or clients, changes plans, deletes evidence or calls an arbitrary API.
• Per-connection and per-organisation concurrency limits, per-call cost ceilings and a per-tool kill switch bound the damage a misbehaving client can do.

Troubleshooting

Every response carries X-Ironfang-Request-ID; a request id or the connection id from ironfang.connection.get is all support needs to find a call. Quote those, never a token.

Privacy

For each MCP call Ironfang records the connection id, organisation, tool name, method, outcome, latency, request size and request id. It does not record tool arguments, prompts, tool results or model output. Rendered outputs are stored as Renderwolf jobs under the organisation's ordinary retention (24 hours for hosted results) and are visible to that organisation in the portal. Consent screens and registrations are recorded as security events on the account. Disconnecting a client revokes its tokens; it does not delete the jobs the organisation already paid for.