MCP server — use Creopus tools from Claude, Cursor and other AI clients

Creopus ships a Model Context Protocol (MCP) server, so an AI client — Claude Desktop, Claude Code, Cursor, or anything else that speaks MCP — can read and create Creopus artifacts directly. Your assistant can pull the requirements for a subsystem, draft a DFMEA against them, and write the result back into your hierarchy, without you leaving the conversation.

The tool list is generated from the platform's own capability manifest, so it never drifts from what the product actually does.

Which plan

Transport	Who it's for	Plan	Status
Streamable HTTP (`https://mcp.creopus.ai/mcp`)	Shared or remote access, multiple clients, nothing to install	Professional, Team and Enterprise	Available
stdio	One person, running locally alongside a desktop AI client	Any plan	Not yet available — see below

stdio is not published yet

The stdio transport runs from an npm package that is not on the public registry, so npx -y @creopus/mcp-server returns a 404. Nothing you can configure makes it work today.

Use the Streamable HTTP transport instead. It needs no install, and it is available on Professional as well as Team and Enterprise.

Before you start: get an API key

Create one in the app under Settings → API keys. Two things to decide at creation time, because they are much easier to set now than to retrofit:

Scopes — read, write, or both. If your assistant only needs to look things up, issue a read-only key. This is the single most effective control available to you.
Allowed tools — an optional per-key whitelist. An empty list means every tool; naming tools restricts the key to exactly those. A key scoped to get_requirements, list_requirements can do nothing else, even if a prompt tries to make it.

Also set an expiry. A key with no expiry is a credential you will still be carrying in two years.

Keys look like creo_live_…. You see the full value once, at creation. We store only a hash, so we cannot recover it for you — if you lose it, revoke and reissue.

Setting up: never paste the key into a config file

This is the part worth getting right.

In 2026, researchers found 24,008 secrets exposed in MCP configuration files on public GitHub, roughly 2,100 of them still valid. Almost none of that was a protocol weakness. It happened because about half of all MCP setup guides tell you to paste your API key straight into mcp.json — and configuration files end up in project directories, and project directories end up committed.

So: put the key in your environment, and reference it from the config.

// Claude Desktop / Cursor — Streamable HTTP. Nothing to install.
{
  "mcpServers": {
    "creopus": {
      "url": "https://mcp.creopus.ai/mcp",
      "headers": {
        // Reference the variable. Do NOT paste the key here.
        "Authorization": "Bearer ${env:CREOPUS_API_KEY}"
      }
    }
  }
}

The stdio form below is kept for when the package ships. It does not work yet — see the note above.

// stdio — NOT YET AVAILABLE, the package is unpublished
{
  "mcpServers": {
    "creopus": {
      "command": "npx",
      "args": ["-y", "@creopus/mcp-server"],
      "env": {
        // Reference the variable. Do NOT paste the key here.
        "CREOPUS_API_KEY": "${env:CREOPUS_API_KEY}"
      }
    }
  }
}

Set the variable itself where your shell or OS keeps secrets:

# macOS — read from Keychain rather than a dotfile
export CREOPUS_API_KEY="$(security find-generic-password -a creopus -s api-key -w)"

# Linux / WSL — a file outside any repo, mode 600
export CREOPUS_API_KEY="$(cat ~/.config/creopus/api-key)"

# Windows — user-scoped environment variable
[Environment]::SetEnvironmentVariable('CREOPUS_API_KEY', '<key>', 'User')

Do not commit your key

Add mcp.json, .mcp.json and .env to .gitignore before you create them. If a key does reach a commit, revoke it in the app first and rewrite history second — revocation is what actually stops the bleeding; history rewriting only removes the evidence.

Do not paste your key into a bug report

The advice above is about config files. The other way keys escape is while you are asking for help: echo $CREOPUS_API_KEY in a terminal transcript, a screenshot of your environment, or a support thread pasted “exactly as it ran”. It looks harmless because you are describing a problem rather than publishing anything — and it puts the full credential in a place that keeps edit history, so deleting it afterwards does not take it back.

When you report something, redact the value: creo_live_<redacted>. If you need to show that the variable is set, show its length or its first few characters, never the whole string — echo ${#CREOPUS_API_KEY} answers the same question.

If one has already gone out, revoke it in the app first. Editing the report is tidying, not remediation.

Remote (Streamable HTTP)

For the hosted endpoint, authenticate with a bearer token instead of a local process:

POST https://mcp.creopus.ai/mcp
Authorization: Bearer creo_live_…

The endpoint is stateless and multi-tenant: your key identifies you, and every request is authorised against your own permissions. It grants exactly what your account can already reach — never more. The same scopes and allowedTools whitelist apply, so a read-only key stays read-only over HTTP.

What you can do with it

Read, create and update the shared artifact tools — requirements, DFMEA and PFMEA, DVP, Pugh, RCCA, BOM, block diagrams, flowcharts, ConOps, ICD, Risk Register, SEMP, CAPA and more — plus navigate the system hierarchy and pull traceability views such as the VCRM and validation matrix.

Mutating tools require a write-scoped key and pass the same usage limits and permission checks as the app. There is no back door: an API key cannot do anything your account cannot.

If something does not work

403 on the remote endpoint — your plan does not include remote MCP (Professional, Team and Enterprise), or the key's allowedTools list excludes the tool being called.
E404 Not Found from npm on npx -y @creopus/mcp-server — expected. The package is not published yet; use the Streamable HTTP transport above.
401 — the key is revoked, expired, or malformed. Check Settings → API keys; each key shows when it was last used.
Tool missing from the list — the manifest is filtered by your key's scopes. A read-only key will not be offered create/update tools at all.

Which plan​

Before you start: get an API key​

Setting up: never paste the key into a config file​

Remote (Streamable HTTP)​

What you can do with it​

If something does not work​