> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Iru MCP

> Connect Cursor, Claude Desktop, OpenAI Codex, or other MCP clients to Iru’s Enterprise API by creating MCP-enabled tokens scoped to your tenant.

### Introduction

The **Model Context Protocol (MCP)** is an open standard for connecting client applications (**hosts**) to **MCP servers**. Servers expose tools, resources, and prompts so AI assistants can take allowed actions in your environment through one consistent pattern, instead of building and maintaining a separate custom integration for every assistant or workflow you add.

The **Iru Model Context Protocol (MCP) server** exposes the Iru **Enterprise API** surface, structured as MCP tools for AI assistants. Connect Cursor, Claude Desktop, OpenAI Codex, or other MCP-enabled clients to query devices, Blueprints, Library Items, and take allowed actions in natural language, without building your own Iru API integration. You can also combine Iru’s tools with tools from other vendors (for example ticketing, chat, or IAM) to create end-to-end workflows orchestrated in natural language. When Iru adds additional Enterprise API capabilities, those capabilities become available through MCP on the same permission model.

<Note>
  The Enterprise API (and the MCP backed by it) applies across Iru areas that surface that API, including Endpoint and other products such as Vulnerability Management and Endpoint Detection and Response, depending on your tenant and entitlements.
</Note>

For REST usage (HTTP APIs and bearer tokens outside MCP), see the [Iru API Overview](/en/endpoint/api/iru-api-overview).

### Before You Begin

* You need an Iru admin account with permission to create and manage **API tokens** in **Access**, as described in the [Iru API Overview](/en/endpoint/api/iru-api-overview).
* You need a **supported MCP client** (such as Claude Desktop, Cursor, or Codex).

### Create an API token with MCP

Use **[Generate an API Token](/en/endpoint/api/iru-api-overview#generate-an-api-token)** in the [Iru API Overview](/en/endpoint/api/iru-api-overview) for the full UI walkthrough (screenshots, **Copy Token**, **Next**, **Configure** / **Skip**, permission grids). The steps here match that article; you must turn on **Enable MCP** before **Create** so Iru issues MCP configuration for this token.

<Steps>
  <Step title="Open Access">
    Click your name at the bottom of the left navigation, then select **Access**.
  </Step>

  <Step title="Open the API tokens tab">
    In **Access**, click the **API tokens** tab.
  </Step>

  <Step title="Create new API token">
    Click **Add Token** to create a new API token.
  </Step>

  <Step title="Configure token details">
    Provide a **Name** and a **Description** for your API token.
  </Step>

  <Step title="Enable MCP">
    Turn on **Enable MCP** before you click **Create.** For MCP, this step is required; if **Enable MCP** is off, you get an Enterprise API token without MCP access or MCP configuration.
  </Step>

  <Step title="Create the token">
    Click **Create.**
  </Step>
</Steps>

<Note>
  **API rate limits:** The Iru Endpoint Management API enforces **10,000 requests per hour per customer**. MCP calls authenticate with the **`X-API-Key`** value under **`headers`** in **MCP configuration** for that token and count toward **the same tenant hourly limit** as direct REST usage and other integrations. **All API tokens in your tenant share that limit.** For background and troubleshooting, see [Considerations](/en/endpoint/api/iru-api-overview#considerations) in the Iru API Overview and the [Iru Endpoint Management API documentation](https://api-docs.kandji.io/).
</Note>

### Copy Your Token and MCP Configuration

After you create the token, Iru shows a one-time success screen: **Your token has been successfully created!** Copy what you need, store it safely, and remember you will not see it again. Run the steps below in order; **MCP configuration** means the JSON from **Copy MCP configuration** in step 2.

<Steps>
  <Step title="Copy the API token (optional for non-MCP API use)">
    For REST or custom scripts, use **Copy** beside the **API token** on the success screen. That value is not used for MCP.
  </Step>

  <Step title="Copy MCP configuration">
    In **MCP configuration**, review the JSON, then use **Copy MCP configuration**. Iru’s snippet is built around **`url`**, **`type`**, and **`headers`**:

    * **URL**: the **`url`** field (the MCP endpoint Iru gives you).
    * **X-API-Key**: the **`X-API-Key`** entry inside **`headers`**. Copy it exactly as Iru shows it, including the **`sk_live:`** prefix already in the snippet; MCP clients send it as the **`X-API-Key`** HTTP header on each request.
    * **X-MCP-Profile**: the **`X-MCP-Profile`** entry inside **`headers`**, sent as the **`X-MCP-Profile`** HTTP header.

    <Note>
      **Copy MCP configuration** is the JSON for MCP. Use the values from **`headers`** exactly as Iru shows them. The **`X-API-Key`** value includes the **`sk_live:`** prefix already in the snippet.
    </Note>

    Placeholder example only:

    ```json mcp.json lines theme={null}
    {
      "mcpServers": {
        "iru": {
          "url": "https://YOUR_TENANT.connect.iru.dev/mcp-server/connector/kandji/tools",
          "type": "http",
          "headers": {
            "X-API-Key": "sk_live:YOUR_API_KEY",
            "X-MCP-Profile": "YOUR_PROFILE_ID"
          }
        }
      }
    }
    ```
  </Step>

  <Step title="Select the confirmation checkbox">
    Select the confirmation checkbox: **I have copied the token and MCP configuration and understand that I will not be able to see these details again.**
  </Step>

  <Step title="Click Next">
    Click **Next**.
  </Step>
</Steps>

<Note>
  If you lose the token or configuration, **revoke** the token and **create a new one**.
</Note>

### Configure API permissions

After you click **Next**, you’ll see a **Manage API Permissions** screen. These permissions control which Enterprise API endpoints the MCP can access.

<Steps>
  <Step title="Configure now or skip">
    Choose one of the following:

    * **Configure** to set permissions now (recommended).
    * **Skip** to set permissions later.
  </Step>

  <Step title="Select endpoints (if you chose Configure)">
    If you clicked **Configure**, use the permissions list to select what this token can do:

    * Expand a category (for example **Blueprints**) to see individual endpoints.
    * Check the boxes for the endpoints you want to allow.
  </Step>

  <Step title="Save">
    When you’re done, click **Save**.
  </Step>

  <Step title="Verify">
    Verify the token shows **MCP enabled: Yes** if you turned on MCP at creation time, and that the permissions you selected are enabled.
  </Step>

  <Step title="Configure permissions later (if you skipped)">
    If you skipped permission setup, you can configure permissions later by opening the token, clicking **Edit**, then selecting the permissions and clicking **Save**.
  </Step>
</Steps>

### Revoke an API token

Revoke the token in **Access** like any other API token. Use **[Revoke a Token](/en/endpoint/api/iru-api-overview#revoke-a-token)** in [Iru API Overview](/en/endpoint/api/iru-api-overview) for the steps and **Activity** notes.

### Considerations

<AccordionGroup>
  <Accordion title="One-time secret display">
    The REST API token from **Copy** and the **MCP configuration** JSON are each shown only once on the success screen at creation time.
  </Accordion>

  <Accordion title="Revocation is total">
    Revoking the token stops API and MCP access that relied on it.
  </Accordion>

  <Accordion title="Destructive actions">
    For destructive operations (for example erase, delete, lock), your assistant should summarize the impact and require your explicit approval before executing, unless you’ve added that action to an allowlist for the MCP. Follow your organization’s change-management rules.
  </Accordion>

  <Accordion title="Pagination">
    Large list responses are paginated. Ask the assistant to refine filters, move to the next page, or export when you need the full dataset without pulling every row into the chat.
  </Accordion>

  <Accordion title="Client-specific config">
    **MCP configuration** is JSON with **`url`**, **`type`**, and **`headers`**. **`headers`** holds **`X-API-Key`** and **`X-MCP-Profile`**, which together are what Iru expects on each MCP request. Point your client at **`url`** and forward those two header values unchanged. The **`X-API-Key`** value includes the **`sk_live:`** prefix already in the snippet.
  </Accordion>
</AccordionGroup>

### Best Practices

<CardGroup cols={2}>
  <Card title="Use least privilege" icon="shield-halved">
    Create a token with only the Enterprise API scopes your automation needs, then enable MCP on that token.
  </Card>

  <Card title="Separate tokens by team or use case" icon="layer-group">
    For example, use a read-focused token for reporting assistants and a narrower operational token for remediation workflows.
  </Card>

  <Card title="Rotate on suspicion" icon="arrows-rotate">
    If **MCP configuration** leaked, revoke the token in Iru and issue a new one; update every MCP client that still has the old **`url`** or **`headers`** values.
  </Card>

  <Card title="Protect local config files" icon="terminal">
    **`claude_desktop_config.json`** contains your **`url`** and header values. Do not commit it to source control or share it in chat logs.
  </Card>

  <Card title="Protect MCP and API secrets" icon="lock">
    Treat **MCP configuration** and any REST token you **Copy** for non-MCP use as secrets. Store them in a password manager or secure vault, not in chat logs or screenshots.
  </Card>
</CardGroup>

### Add the Iru MCP to Your MCP Client

Choose a client, then follow the steps for that host.

<Tabs>
  <Tab title="Claude Desktop" icon="desktop" iconType="solid">
    ### Add the Iru MCP to Claude Desktop

    **Claude Desktop** is Anthropic’s desktop app for chatting with Claude. Register Iru by editing **`claude_desktop_config.json`** with the **`url`** and **`headers`** values from your **MCP configuration**.

    ### Prerequisites

    * In Iru, complete [Copy your token and MCP configuration](#copy-your-token-and-mcp-configuration) so you have **`url`** and **`headers`** (**`X-API-Key`**, **`X-MCP-Profile`**).
    * Install **Node.js 20+** from [nodejs.org](https://nodejs.org/). The installer includes **`npx`**, which Claude Desktop uses to run the Iru MCP connection.

    <Tabs>
      <Tab title="macOS" icon="apple" iconType="brands">
        <Steps>
          <Step title="Download and install Claude Desktop">
            Download Claude Desktop for macOS, install the app, and sign in: [Download Claude](https://claude.com/download).
          </Step>

          <Step title="Open Claude Desktop settings">
            Open Claude Desktop, then select **Claude → Settings** from the menu bar.
          </Step>

          <Step title="Open Developer settings">
            In **Settings**, select **Developer**.
          </Step>

          <Step title="Open the configuration file">
            Under **Developer**, select **Edit Config**. Claude Desktop opens the config folder in **Finder**.
          </Step>

          <Step title="Open claude_desktop_config.json">
            Open **`claude_desktop_config.json`** from that folder in your preferred text editor.

            <Note>
              A new file may show **`{}`**. An existing file may already include **`mcpServers`**, **`preferences`**, or other settings. In that case, add only the **`"iru"`** block inside **`mcpServers`** and leave the rest unchanged. After the closing **`}`** of **`mcpServers`**, add a comma before the next top-level section (for example **`"preferences"`**).
            </Note>
          </Step>

          <Step title="Add the Iru MCP server entry">
            Paste into **`claude_desktop_config.json`**. The three highlighted lines are where you add your values from **MCP configuration**. Put your **`X-API-Key`** and **`X-MCP-Profile`** in **`env`**; when Claude Desktop starts, **`mcp-remote`** uses those values for the **`${IRU_X_API_KEY}`** and **`${IRU_X_MCP_PROFILE}`** placeholders in **`args`**.

            ```json claude_desktop_config.json lines highlight={8,15,16} theme={null}
            {
              "mcpServers": {
                "iru": {
                  "command": "npx",
                  "args": [
                    "-y",
                    "mcp-remote@0.1.13",
                    "https://YOUR_TENANT.connect.iru.dev/mcp-server/connector/kandji/tools",
                    "--header",
                    "X-API-Key:${IRU_X_API_KEY}",
                    "--header",
                    "X-MCP-Profile:${IRU_X_MCP_PROFILE}"
                  ],
                  "env": {
                    "IRU_X_API_KEY": "sk_live:YOUR_API_KEY",
                    "IRU_X_MCP_PROFILE": "YOUR_PROFILE_ID"
                  }
                }
              }
            }
            ```

            Replace the highlighted placeholders:

            * **`https://YOUR_TENANT.connect.iru.dev/mcp-server/connector/kandji/tools`** with **`url`** from **MCP configuration**
            * **`sk_live:YOUR_API_KEY`** with **`X-API-Key`** from **MCP configuration**
            * **`YOUR_PROFILE_ID`** with **`X-MCP-Profile`** from **MCP configuration**
          </Step>

          <Step title="Merge into an existing file">
            Skip this step if you started from an empty file. When **`preferences`** or other settings already sit below **`mcpServers`**, your file should connect the sections like this. The highlighted line is the comma between **`mcpServers`** and the next top-level key:

            ```json claude_desktop_config.json lines highlight={4} theme={null}
                    "IRU_X_MCP_PROFILE": "YOUR_PROFILE_ID"
                  }
                }
              },
              "preferences": {
                "remoteToolsDeviceName": "your-device-name",
                "coworkWebSearchEnabled": true
              }
            }
            ```
          </Step>

          <Step title="Save the file and restart Claude Desktop">
            Save **`claude_desktop_config.json`**, then fully quit Claude Desktop. Closing the window is not enough; select **Claude → Quit Claude** from the menu bar, then relaunch Claude Desktop.

            Claude Desktop loads MCP configuration on start-up.
          </Step>

          <Step title="Verify the connection">
            After Claude Desktop reopens, start a **new chat** and ask:

            ```text theme={null}
            List my Iru devices
            ```

            If the connection is working, Claude calls the Iru MCP server and returns a list of your enrolled devices. If you see an error, see [Troubleshooting](#troubleshooting) below.
          </Step>

          <Step title="Approve access when prompted">
            Claude prompts before each Iru MCP tool use. Choose **Allow once** for that run only, or **Always allow** when you want fewer prompts for similar actions. Approve when you want reads or allowed changes in Iru; decline if you do not want the tool to run.
          </Step>

          <Step title="If something still fails">
            In Claude Desktop, open **Settings → Developer** to review the **`iru`** entry, whether the server is running, and any errors the host reports. See [Troubleshooting](#troubleshooting) below.
          </Step>
        </Steps>
      </Tab>

      <Tab title="Windows" icon="microsoft" iconType="brands">
        <Steps>
          <Step title="Download and install Claude Desktop">
            Download Claude Desktop for Windows, install the app, and sign in: [Download Claude](https://claude.com/download).
          </Step>

          <Step title="Open Claude Desktop settings">
            Open Claude Desktop, then select the hamburger menu, **File**, then **Settings**.
          </Step>

          <Step title="Open Developer settings">
            In **Settings**, select **Developer**.
          </Step>

          <Step title="Open the configuration file">
            Under **Developer**, select **Edit Config**. Claude Desktop opens the config folder in **File Explorer**.
          </Step>

          <Step title="Open claude_desktop_config.json">
            Open **`claude_desktop_config.json`** from that folder in your preferred text editor.

            <Note>
              A new file may show **`{}`**. An existing file may already include **`mcpServers`**, **`preferences`**, or other settings. In that case, add only the **`"iru"`** block inside **`mcpServers`** and leave the rest unchanged. After the closing **`}`** of **`mcpServers`**, add a comma before the next top-level section (for example **`"preferences"`**).
            </Note>
          </Step>

          <Step title="Add the Iru MCP server entry">
            Paste into **`claude_desktop_config.json`**. The three highlighted lines are where you add your values from **MCP configuration**. Put your **`X-API-Key`** and **`X-MCP-Profile`** in **`env`**; when Claude Desktop starts, **`mcp-remote`** uses those values for the **`${IRU_X_API_KEY}`** and **`${IRU_X_MCP_PROFILE}`** placeholders in **`args`**.

            ```json claude_desktop_config.json lines highlight={8,15,16} theme={null}
            {
              "mcpServers": {
                "iru": {
                  "command": "C:\\Program Files\\nodejs\\npx.cmd",
                  "args": [
                    "-y",
                    "mcp-remote@0.1.13",
                    "https://YOUR_TENANT.connect.iru.dev/mcp-server/connector/kandji/tools",
                    "--header",
                    "X-API-Key:${IRU_X_API_KEY}",
                    "--header",
                    "X-MCP-Profile:${IRU_X_MCP_PROFILE}"
                  ],
                  "env": {
                    "IRU_X_API_KEY": "sk_live:YOUR_API_KEY",
                    "IRU_X_MCP_PROFILE": "YOUR_PROFILE_ID"
                  }
                }
              }
            }
            ```

            Replace the highlighted placeholders:

            * **`https://YOUR_TENANT.connect.iru.dev/mcp-server/connector/kandji/tools`** with **`url`** from **MCP configuration**
            * **`sk_live:YOUR_API_KEY`** with **`X-API-Key`** from **MCP configuration**
            * **`YOUR_PROFILE_ID`** with **`X-MCP-Profile`** from **MCP configuration**
          </Step>

          <Step title="Merge into an existing file">
            Skip this step if you started from an empty file. When **`preferences`** or other settings already sit below **`mcpServers`**, your file should connect the sections like this. The highlighted line is the comma between **`mcpServers`** and the next top-level key:

            ```json claude_desktop_config.json lines highlight={4} theme={null}
                    "IRU_X_MCP_PROFILE": "YOUR_PROFILE_ID"
                  }
                }
              },
              "preferences": {
                "remoteToolsDeviceName": "your-device-name",
                "coworkWebSearchEnabled": true
              }
            }
            ```
          </Step>

          <Step title="Save the file and restart Claude Desktop">
            Save **`claude_desktop_config.json`**, then fully quit Claude Desktop. Closing the window is not enough; right-click the **Claude** icon in the system tray and select **Quit**, then relaunch Claude Desktop.

            Claude Desktop loads MCP configuration on start-up.
          </Step>

          <Step title="Verify the connection">
            After Claude Desktop reopens, start a **new chat** and ask:

            ```text theme={null}
            List my Iru devices
            ```

            If the connection is working, Claude calls the Iru MCP server and returns a list of your enrolled devices. If you see an error, see [Troubleshooting](#troubleshooting) below.
          </Step>

          <Step title="Approve access when prompted">
            Claude prompts before each Iru MCP tool use. Choose **Allow once** for that run only, or **Always allow** when you want fewer prompts for similar actions. Approve when you want reads or allowed changes in Iru; decline if you do not want the tool to run.
          </Step>

          <Step title="If something still fails">
            In Claude Desktop, open **Settings → Developer** to review the **`iru`** entry, whether the server is running, and any errors the host reports. When the MCP server runs, Claude may also write **`logs\mcp-server-iru.log`** next to **`claude_desktop_config.json`** in the Claude Desktop app data folder for your install. See [Troubleshooting](#troubleshooting) below.
          </Step>
        </Steps>
      </Tab>
    </Tabs>
  </Tab>

  <Tab title="Cursor" icon="i-cursor" iconType="solid">
    ### Add the Iru MCP to Cursor

    **Cursor** is an AI-native code editor for writing and editing software with built-in assistance. The Cursor desktop app is available on **macOS**, **Windows**, and **Linux**. Add Iru under **Tools & MCP** so you can use your tenant’s tools from the editor.

    <Steps>
      <Step title="Prepare values from Iru">
        In Iru, complete [Copy your token and MCP configuration](#copy-your-token-and-mcp-configuration) so you have **`url`** and **`headers`** (**`X-API-Key`**, **`X-MCP-Profile`**).
      </Step>

      <Step title="Download and install Cursor">
        Download Cursor for your platform, install the app, and sign in: [Download Cursor](https://cursor.com/download).
      </Step>

      <Step title="Open MCP settings">
        Open Cursor **MCP Settings**:

        * **macOS:** **Cursor → Settings → Cursor Settings**, then **Tools & MCP**.
        * **Windows/Linux:** **File → Preferences → Cursor Settings**, then **Tools & MCP**.
      </Step>

      <Step title="Add Custom MCP">
        Click **Add Custom MCP**.
      </Step>

      <Step title="Paste MCP configuration">
        The **`mcp.json`** file opens in the editor. How you paste depends on whether other MCP servers are already defined. Cursor starts with a placeholder like this:

        ```json mcp.json lines theme={null}
        {
          "mcpServers": {}
        }
        ```

        <AccordionGroup>
          <Accordion title="New setup">
            Replace the **entire** contents of **`mcp.json`** with the complete **MCP configuration** you copied from [Copy MCP configuration](#copy-your-token-and-mcp-configuration) when you created the token. Select everything in the file (including Cursor’s placeholder), paste, and leave **only** Iru’s JSON in **`mcp.json`**. Do not remove the **`sk_live:`** prefix from **`X-API-Key`** in **`headers`**.
          </Accordion>

          <Accordion title="Existing MCP servers">
            If **`mcpServers`** already lists other servers you want to keep, do **not** replace the whole **`mcp.json`** file. Add only the **`iru`** block from **MCP configuration**. Copy from **`"iru": {`** through the closing **`}`** for that server (the second **`}`** after **`headers`**). Add a comma after the closing **`}`** of the server entry that comes immediately before **`iru`**. Keep **`X-API-Key`** exactly as Iru shows it, including the **`sk_live:`** prefix already in the snippet.

            Example when another server is already configured (highlighted lines show the trailing comma and the **`iru`** block to copy and paste into the **`mcp.json`** file):

            ```json mcp.json lines highlight={10,11-18} theme={null}
            {
              "mcpServers": {
                "previous-mcp-server": {
                  "url": "https://example.com/mcp",
                  "type": "http",
                  "headers": {
                    "X-API-Key": "sk_live:YOUR_OTHER_KEY",
                    "X-MCP-Profile": "YOUR_OTHER_PROFILE"
                  }
                },
                "iru": {
                  "url": "https://YOUR_TENANT.connect.iru.dev/mcp-server/connector/kandji/tools",
                  "type": "http",
                  "headers": {
                    "X-API-Key": "sk_live:YOUR_API_KEY",
                    "X-MCP-Profile": "YOUR_PROFILE_ID"
                  }
                }
              }
            }
            ```
          </Accordion>
        </AccordionGroup>
      </Step>

      <Step title="Save the configuration">
        Cursor does not save **`mcp.json`** automatically after you paste. Save the file manually before you quit or restart:

        * **macOS:** **Command+S**
        * **Windows/Linux:** **Ctrl+S**, or **File → Save**
      </Step>

      <Step title="Restart Cursor">
        **Fully quit Cursor**, then reopen it. Cursor loads MCP on startup.
      </Step>

      <Step title="Confirm">
        Return to **Tools & MCP**. Confirm **`iru`** appears and the toggle shows **enabled.**
      </Step>
    </Steps>

    For more on using MCP in Cursor, see [Model Context Protocol (MCP) in Cursor](https://cursor.com/docs/mcp).
  </Tab>

  <Tab title="OpenAI Codex" icon="openai" iconType="brands">
    ### Add the Iru MCP to OpenAI Codex

    **OpenAI Codex** is OpenAI’s coding agent for building and changing software with AI. Use the **Codex Desktop App** or the **Codex** extension in VS Code to register Iru as an MCP server and work with your tenant from chat.

    <Tabs>
      <Tab title="Desktop App" icon="window-maximize" iconType="solid">
        #### Codex Desktop App

        The Codex Desktop App is available on **macOS** and **Windows**. For platform support, install options (including Intel Mac builds), and other app requirements, see the [Codex app documentation](https://developers.openai.com/codex/app) on OpenAI Developers.

        <Steps>
          <Step title="Prepare values from Iru">
            In Iru, complete [Copy your token and MCP configuration](#copy-your-token-and-mcp-configuration) so you have **`url`** and **`headers`** (**`X-API-Key`**, **`X-MCP-Profile`**).
          </Step>

          <Step title="Download and install Codex">
            Download the Codex Desktop App and install it: [Codex](https://chatgpt.com/codex/).
          </Step>

          <Step title="Sign in to Codex">
            Open Codex and sign in with your ChatGPT account or an OpenAI API key. Codex is included with eligible ChatGPT plans. See [Open Codex and sign in](https://developers.openai.com/codex/app) in the Codex app documentation.
          </Step>

          <Step title="Open Settings">
            In Codex, go to **Settings**.
          </Step>

          <Step title="Open MCP servers">
            Select **MCP servers**.
          </Step>

          <Step title="Add server">
            Click **+ Add server**.
          </Step>

          <Step title="Name">
            Enter **Iru MCP** for **Name**.
          </Step>

          <Step title="Transport">
            Select **Streamable HTTP**.
          </Step>

          <Step title="URL">
            Enter the **`url`** value from **MCP configuration** in **URL**.
          </Step>

          <Step title="Header for X-API-Key">
            Under **Headers**, set **Key** to **`X-API-Key`** and **Value** to the **`X-API-Key`** entry from **`headers`** in **MCP configuration**, copied exactly as Iru shows it, including the **`sk_live:`** prefix already in the snippet.
          </Step>

          <Step title="Header for X-MCP-Profile">
            Click **+ Add header**. Set **Key** to **`X-MCP-Profile`** and **Value** to the **`X-MCP-Profile`** entry from **`headers`** in **MCP configuration**.
          </Step>

          <Step title="Save">
            Click **Save**.
          </Step>

          <Step title="Restart Codex">
            Fully quit Codex, then open it again so it reloads MCP settings.
          </Step>

          <Step title="Try Iru in chat">
            Start a **new chat** and ask Codex a question about an Enterprise API area your token has permission to use (for example devices or Blueprints).
          </Step>
        </Steps>
      </Tab>

      <Tab title="IDE extension" icon="puzzle-piece" iconType="solid">
        #### Codex IDE extension

        The **Codex IDE extension** runs OpenAI’s coding agent in your editor. Add Iru through the extension’s MCP settings.

        <Steps>
          <Step title="Prepare values from Iru">
            In Iru, complete [Copy your token and MCP configuration](#copy-your-token-and-mcp-configuration) so you have **`url`** and **`headers`** (**`X-API-Key`**, **`X-MCP-Profile`**).
          </Step>

          <Step title="Install Visual Studio Code">
            Install [Visual Studio Code](https://code.visualstudio.com/) if needed. VS Code supports **macOS**, **Windows**, and **Linux**.
          </Step>

          <Step title="Install the Codex extension">
            Install the [Codex extension](https://marketplace.visualstudio.com/items?itemName=openai.chatgpt) from the Visual Studio Marketplace. The extension also works in other VS Code–compatible editors (for example Cursor); menus and platform support may differ. See the [Codex IDE extension](https://developers.openai.com/codex/ide) documentation for install options.
          </Step>

          <Step title="Open the Codex sidebar">
            Open the Codex sidebar using the <Icon icon="openai" iconType="brands" size={14} style={{ display: 'inline-flex', verticalAlign: 'middle' }} /> OpenAI logo in the activity bar, **Open Codex Sidebar**, or by toggling the secondary sidebar and selecting the **Codex** tab.
          </Step>

          <Step title="Sign in and complete setup">
            Click **Sign in with ChatGPT** and authenticate. Codex is included with eligible ChatGPT plans. Follow any prompts to finish setup.
          </Step>

          <Step title="Open Codex settings">
            In the Codex sidebar, click the **gear** icon, then **Codex settings**.
          </Step>

          <Step title="Open MCP servers">
            Click **MCP servers**.
          </Step>

          <Step title="Add server">
            Click **+ Add server**.
          </Step>

          <Step title="Name">
            Enter **Iru MCP** for **Name**.
          </Step>

          <Step title="Transport">
            Select **Streamable HTTP**.
          </Step>

          <Step title="URL">
            Enter the **`url`** value from **MCP configuration** in **URL**.
          </Step>

          <Step title="Header for X-API-Key">
            Under **Headers**, set **Key** to **`X-API-Key`** and **Value** to the **`X-API-Key`** entry from **`headers`** in **MCP configuration**, copied exactly as Iru shows it, including the **`sk_live:`** prefix already in the snippet.
          </Step>

          <Step title="Header for X-MCP-Profile">
            Click **+ Add header**. Set **Key** to **`X-MCP-Profile`** and **Value** to the **`X-MCP-Profile`** entry from **`headers`** in **MCP configuration**.
          </Step>

          <Step title="Save">
            Click **Save**.
          </Step>

          <Step title="Restart the extension">
            If Codex shows **Restart extension**, click it so MCP settings reload.
          </Step>

          <Step title="Try Iru in chat">
            In the **Codex** sidebar, start a conversation and ask about an Enterprise API area your token has permission to use (for example devices or Blueprints).
          </Step>
        </Steps>
      </Tab>
    </Tabs>
  </Tab>
</Tabs>

### Troubleshooting

For MCP-wide help (log locations, configuration checks, MCP Inspector, and client debugging beyond the Iru-specific notes below), see the [Model Context Protocol debugging guide](https://modelcontextprotocol.io/docs/tools/debugging).

<AccordionGroup>
  <Accordion title="General Iru MCP" icon="layer-group">
    <AccordionGroup>
      <Accordion title="The assistant says the token is invalid or authentication failed" icon="key">
        Re-check **`url`** and **`headers`** (**`X-API-Key`**, **`X-MCP-Profile`**) in **MCP configuration**. Remove stray spaces. **`X-API-Key`** must match the full value from Iru, including the **`sk_live:`** prefix already in the snippet. If the backing token was rotated or revoked, create a new one and refresh every client.
      </Accordion>

      <Accordion title="Tools are missing or the assistant reports permission denied" icon="shield-halved">
        The Enterprise API scopes on the token can block those operations. Edit the token’s API permissions in **Access**, or create a new token with the scopes you need.
      </Accordion>

      <Accordion title="Configuration looks correct in Iru but the client still fails" icon="arrow-rotate-right">
        Confirm **MCP configuration** in the client matches **`url`** and **`headers`** from Iru, then fully quit and restart the host app so it reloads MCP settings. If the problem persists, use the [Model Context Protocol debugging guide](https://modelcontextprotocol.io/docs/tools/debugging) for host logs, JSON validation, and testing with MCP Inspector.
      </Accordion>
    </AccordionGroup>
  </Accordion>

  <Accordion title="Claude Desktop" icon="desktop" iconType="solid">
    <AccordionGroup>
      <Accordion title="Remote connector or network error (custom MCP URL)" icon="globe">
        Custom connectors reach your MCP server from Anthropic’s infrastructure. Confirm that **`url`** in **MCP configuration** is correct, that the service is on the public internet, and that any corporate firewall allows Anthropic’s IP ranges. See [Get started with custom connectors using remote MCP](https://support.claude.com/en/articles/11175166-get-started-with-custom-connectors-using-remote-mcp) and [Anthropic IP addresses](https://platform.claude.com/docs/en/api/ip-addresses).
      </Accordion>

      <Accordion title="Inspect the iru entry or read host errors" icon="wrench">
        In Claude Desktop, open **Settings**, then **Developer**. There you can review the **`iru`** server configuration, see whether the server is running, and read any errors the host reports. For Claude log paths, DevTools, and related steps, see **Debugging in Claude Desktop** in the [Model Context Protocol debugging guide](https://modelcontextprotocol.io/docs/tools/debugging).
      </Accordion>

      <Accordion title="stdio bridge (npx / mcp-remote) or config file setup" icon="terminal">
        Confirm **Node.js 20+** is installed, then open **`claude_desktop_config.json`** and confirm the **`iru`** entry’s MCP URL in **`args`** and the values in **`env`** still match **`url`**, **`X-API-Key`**, and **`X-MCP-Profile`** from **MCP configuration** (**`IRU_X_API_KEY`** must include the **`sk_live:`** prefix). The **`--header`** lines should still use **`${IRU_X_API_KEY}`** and **`${IRU_X_MCP_PROFILE}`**, not your raw key or profile. On macOS, **`command`** should be **`npx`**; on Windows, use the full path **`C:\Program Files\nodejs\npx.cmd`**. Save the file and **fully quit** Claude Desktop (**Claude → Quit Claude** on macOS, tray **Quit** on Windows) before reopening. On Windows, check **`logs\mcp-server-iru.log`** beside **`claude_desktop_config.json`** if **`iru`** still fails. See [Add the Iru MCP to Claude Desktop](#claude-desktop).
      </Accordion>
    </AccordionGroup>
  </Accordion>

  <Accordion title="Cursor" icon="i-cursor" iconType="solid">
    <AccordionGroup>
      <Accordion title="MCP does not load or iru stays off after editing settings" icon="arrow-rotate-right">
        **Fully quit Cursor**, then reopen it; Cursor loads MCP on startup. If **`mcp.json`** still fails to load, confirm valid JSON. For a new setup, confirm you replaced the **entire** file with **MCP configuration**; if you merged into existing servers, confirm the **`iru`** block and commas are correct. Check that **`url`**, **`X-API-Key`**, and **`X-MCP-Profile`** match **MCP configuration** (see [Add the Iru MCP to Cursor](#cursor)). **`X-API-Key`** must include the **`sk_live:`** prefix already in the snippet. For deeper host issues, see the [Model Context Protocol debugging guide](https://modelcontextprotocol.io/docs/tools/debugging).
      </Accordion>
    </AccordionGroup>
  </Accordion>

  <Accordion title="OpenAI Codex" icon="openai" iconType="brands">
    <AccordionGroup>
      <Accordion title="Add a project to use Codex (IDE extension)" icon="folder-open">
        If Codex shows **Add a project to use Codex** when you chat, open or create a project folder in the editor first, then return to the **Codex** sidebar.
      </Accordion>

      <Accordion title="Codex: edit config.toml directly" icon="file-code">
        If you cannot save or change MCP settings in the UI, edit **`~/.codex/config.toml`** directly. Per [Model Context Protocol in Codex](https://developers.openai.com/codex/mcp), the CLI, **Codex IDE extension**, and **Codex Desktop App** share this file. See [Codex IDE extension](#ide-extension) or [Codex Desktop App](#desktop-app) for the UI setup flows.

        Open **`~/.codex/config.toml`** in a text editor. The **`~`** is your home folder (for example **`/Users/your-user-name/.codex/config.toml`** on macOS).

        Set **`url`** and **`http_headers`** from **MCP configuration**, copied exactly as Iru shows them. The **`X-API-Key`** value in **`http_headers`** includes the **`sk_live:`** prefix already in the snippet. Use **Iru MCP** as the server name. In **`config.toml`**, the table name after **`mcp_servers.`** must match how Codex stored that server (often derived from **Iru MCP**, for example **`iru_mcp`**).

        Example for **Iru MCP**:

        ```toml config.toml lines theme={null}
        [mcp_servers.iru_mcp]
        enabled = true
        url = "https://YOUR_TENANT.connect.iru.dev/mcp-server/connector/kandji/tools"
        http_headers = { "X-API-Key" = "sk_live:YOUR_API_KEY", "X-MCP-Profile" = "YOUR_PROFILE_ID" }
        ```

        Save the file, then **fully quit** Codex or restart your editor so MCP settings reload.
      </Accordion>

      <Accordion title="MCP server does not connect or tools stay offline" icon="arrow-rotate-right">
        Confirm **Iru MCP** is enabled in Codex MCP settings, **`url`** and **`headers`** match **MCP configuration** (**`X-API-Key`** must include the **`sk_live:`** prefix already in the snippet), then **fully quit** the host app and reopen it so Codex reloads MCP. For the **Codex IDE extension**, this means quitting the editor; for the **Codex Desktop App**, quit Codex completely. For transport-level debugging, see the [Model Context Protocol debugging guide](https://modelcontextprotocol.io/docs/tools/debugging).
      </Accordion>
    </AccordionGroup>
  </Accordion>
</AccordionGroup>

### Related Articles

<CardGroup cols={2}>
  <Card title="Iru API Overview" icon="file-lines" href="/en/endpoint/api/iru-api-overview">
    REST APIs, tokens, permissions, and Activity for the Enterprise API that MCP exposes as tools.
  </Card>

  <Card title="How to Set Up the Iru Endpoint API in Postman" icon="flask" href="/en/endpoint/api/how-to-set-up-the-iru-endpoint-api-in-postman">
    Import the published collection and send authenticated requests outside MCP.
  </Card>

  <Card title="Iru Endpoint Management API reference" icon="book" href="https://api-docs.kandji.io">
    Browse endpoints, parameters, and request and response examples for the underlying API.
  </Card>

  <Card title="Integrating Third-Party Apps Using the Iru Endpoint API" icon="plug" href="/en/endpoint/integrations/overview/integrating-third-party-apps-using-the-iru-endpoint-api">
    Connect third-party products and map the API permissions each integration needs.
  </Card>
</CardGroup>