Aevum Security runs a public MCP server so ChatGPT, Claude and any other AI agent can read our cybersecurity service catalogue and raise a business enquiry — with signed requests, verifiable receipts and a zero-side-effect sandbox.
Most of this website is written for people. This page is the front door for the other kind of visitor: an AI agent acting on someone's behalf.
Instead of asking a language model to scrape our marketing pages and guess, we publish a proper machine interface. An agent can ask which cybersecurity services we offer, pull the full detail of any one of them, and — with a key and its principal's consent — send us a real business enquiry. The read tools return a structured service catalogue; refer to the service pages for the website descriptions.
The interface speaks the Model Context Protocol (MCP), the standard ChatGPT and Claude both use for connecting to external tools. The same three capabilities are also available as a plain REST API described by OpenAPI, for agents and integrations that do not speak MCP.
MCP server URL — paste this into an MCP client:
https://agents.aevumsecurity.com.sg/mcpOpening this URL in a browser returns HTTP 405. This is expected: MCP clients send JSON-RPC messages using HTTP POST, while a browser visit sends GET. To browse the available resources, use the agent surface home page or llms.txt.
It is a streamable-HTTP MCP server. The two read-only tools work with no credentials at all — paste the URL into your client and start asking.
Settings → Security and login → turn on Developer mode. Then open the connector list, add a connector and paste https://agents.aevumsecurity.com.sg/mcp.
curl https://api.openai.com/v1/responses \
-H "Authorization: Bearer $OPENAI_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"model": "gpt-5",
"tools": [{
"type": "mcp",
"server_label": "aevum_security",
"server_url": "https://agents.aevumsecurity.com.sg/mcp",
"require_approval": "never"
}],
"input": "Which cybersecurity services does Aevum Security offer?"
}'claude mcp add --transport http aevum-security https://agents.aevumsecurity.com.sg/mcpSettings → Connectors → Add custom connector → paste https://agents.aevumsecurity.com.sg/mcp.
{
"mcpServers": {
"aevum-security": {
"type": "http",
"url": "https://agents.aevumsecurity.com.sg/mcp"
}
}
}| Tool | Access | What it does |
|---|---|---|
list_services |
Read · no key | Lists Aevum Security's cybersecurity services — slug, name and a one-line summary. Use the slug with the other two tools. |
get_service_details |
Read · no key | Full details of one service, by slug: cyberpatch, cybermonitor, cyberbaseline or cyberforensic. |
submit_enquiry |
Write · bearer key | Sends a business enquiry to Aevum Security on behalf of your principal. This creates a real enquiry that a human reads and answers within one business day — only call it with the principal's consent. Returns an enquiry id and a signed receipt. |
Anything below works anonymously and changes nothing:
# 1. what tools exist
curl -sX POST https://agents.aevumsecurity.com.sg/mcp \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
# 2. the service catalogue, over plain REST
curl -sX POST https://agents.aevumsecurity.com.sg/actions/list_services -d '{}'
# 3. one service in full
curl -sX POST https://agents.aevumsecurity.com.sg/actions/get_service_details \
-H 'Content-Type: application/json' -d '{"service":"cyberpatch"}'Read tools need nothing. list_services and get_service_details are genuinely public — no key, no OAuth, no sign-up.
submit_enquiry needs a bearer agent key, sent as Authorization: Bearer <key> on the HTTP connection. Request one at [email protected].
Be aware: some AI clients — ChatGPT's directory connectors among them — cannot pass a custom bearer key to an MCP server. In those clients the two read tools work fine and submit_enquiry will return an authentication error. That is a limitation of the client, not a fault in your setup. Claude Code, the OpenAI API, and any self-configured MCP client can all send the header. If you cannot, just use the contact form — it reaches the same inbox.
An API that a machine can call on someone else's behalf needs more than an API key. We are a security company; this surface is built the way we would want a vendor's to be built.
/sandbox or send B2A-Environment: sandbox./receipts/{id}.Idempotency-Key, or rely on input-hash dedup — a retried call replays the original result instead of raising a second enquiry.Everything below is a plain GET. The manifest is the one to start from — it lists every other endpoint.
Email [email protected] for an agent key, an integration question, or to tell us a tool did something surprising. A human answers within one business day.
If you are here as a person rather than on behalf of one, our cybersecurity services and contact form are the shorter route.