Aevum Security runs a public MCP server so ChatGPT, Claude and any other AI agent can read our cybersecurity service catalogue and raise a business enquiry — with signed requests, verifiable receipts and a zero-side-effect sandbox.
Most of this website is written for people. This page is the front door for the other kind of visitor: an AI agent acting on someone's behalf.
Instead of asking a language model to scrape our marketing pages and guess, we publish a proper machine interface. An agent can ask which cybersecurity services we offer, pull the full detail of any one of them, and — with a key and its principal's consent — send us a real business enquiry. Every answer comes from the same source of truth this website is built from, so an agent never quotes a stale page.
The interface speaks the Model Context Protocol (MCP), the standard ChatGPT and Claude both use for connecting to external tools. The same three capabilities are also available as a plain REST API described by OpenAPI, for agents and integrations that do not speak MCP.
The MCP endpoint is:
https://agents.aevumsecurity.com.sg/mcpIt is a streamable-HTTP MCP server. The two read-only tools work with no credentials at all — paste the URL into your client and start asking.
claude mcp add --transport http aevum-security https://agents.aevumsecurity.com.sg/mcpSettings → Connectors → Add custom connector → paste https://agents.aevumsecurity.com.sg/mcp.
Settings → Security and login → turn on Developer mode. Then open the connector list, add a connector and paste https://agents.aevumsecurity.com.sg/mcp.
curl https://api.openai.com/v1/responses \
-H "Authorization: Bearer $OPENAI_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"model": "gpt-5",
"tools": [{
"type": "mcp",
"server_label": "aevum_security",
"server_url": "https://agents.aevumsecurity.com.sg/mcp",
"require_approval": "never"
}],
"input": "Which cybersecurity services does Aevum Security offer?"
}'{
"mcpServers": {
"aevum-security": {
"type": "http",
"url": "https://agents.aevumsecurity.com.sg/mcp"
}
}
}Transport note. /mcp is JSON-RPC over HTTP POST only. A GET returns 405 with a pointer to the protocol — that is correct MCP behaviour, not an outage. If you want something readable in a browser, start at the agent surface home page or the llms.txt.
| Tool | Access | What it does |
|---|---|---|
list_services |
Read · no key | Lists Aevum Security's cybersecurity services — slug, name and a one-line summary. Use the slug with the other two tools. |
get_service_details |
Read · no key | Full details of one service, by slug: cyberpatch, cybermonitor, cyberbaseline or cyberforensic. |
submit_enquiry |
Write · bearer key | Sends a business enquiry to Aevum Security on behalf of your principal. This creates a real enquiry that a human reads and answers within one business day — only call it with the principal's consent. Returns an enquiry id and a signed receipt. |
Anything below works anonymously and changes nothing:
# 1. what tools exist
curl -sX POST https://agents.aevumsecurity.com.sg/mcp \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
# 2. the service catalogue, over plain REST
curl -sX POST https://agents.aevumsecurity.com.sg/actions/list_services -d '{}'
# 3. one service in full
curl -sX POST https://agents.aevumsecurity.com.sg/actions/get_service_details \
-H 'Content-Type: application/json' -d '{"service":"cyberpatch"}'Read tools need nothing. list_services and get_service_details are genuinely public — no key, no OAuth, no sign-up.
submit_enquiry needs a bearer agent key, sent as Authorization: Bearer <key> on the HTTP connection. Request one at [email protected].
Be aware: some AI clients — ChatGPT's directory connectors among them — cannot pass a custom bearer key to an MCP server. In those clients the two read tools work fine and submit_enquiry will return an authentication error. That is a limitation of the client, not a fault in your setup. Claude Code, the OpenAI API, and any self-configured MCP client can all send the header. If you cannot, just use the contact form — it reaches the same inbox.
An API that a machine can call on someone else's behalf needs more than an API key. We are a security company; this surface is built the way we would want a vendor's to be built.
/sandbox or send B2A-Environment: sandbox./receipts/{id}.Idempotency-Key, or rely on input-hash dedup — a retried call replays the original result instead of raising a second enquiry.Everything below is a plain GET. The manifest is the one to start from — it lists every other endpoint.
Email [email protected] for an agent key, an integration question, or to tell us a tool did something surprising. A human answers within one business day.
If you are here as a person rather than on behalf of one, our cybersecurity services and contact form are the shorter route.