MCP server

Updated 23 October 2026

Connect your AI assistant to Bot403 and let it do the setup. It signs you up, creates the site, adds the script tag to your page and the check to your server. You only click the sign-in link in your email.

Connect

Run one command in your terminal:

# Claude Code
claude mcp add --transport http bot403 https://bot403.com/mcp

# Codex
codex mcp add bot403 --url https://bot403.com/mcp

# Gemini CLI
gemini mcp add --transport http bot403 https://bot403.com/mcp

In an app, add the URL https://bot403.com/mcp as a connector:

Claude (claude.ai and desktop): Settings → Connectors → Add custom connector.
ChatGPT: Settings → Connectors → Developer mode → Add.
Cursor: add it to .cursor/mcp.json:

{ "mcpServers": { "bot403": { "url": "https://bot403.com/mcp" } } }

The first time, your assistant opens the Bot403 sign-in page. Enter your email, click the link in your inbox, and click Allow. A new email gets a new free account. You can revoke the access under Settings → Connected apps.

Example prompts

"Protect the contact form in this project with Bot403."
"Create a Bot403 site called Newsletter and add it to the sign-up form."
"How many submissions did Bot403 block this week, and why?"

Tools

Tool	What it does
`list_sites`	Lists your sites with their public keys, origins and difficulty (low, medium or high), and your plan.
`create_site`	Creates a site and returns its keys and the script tag to paste. The secret key comes back once.
`update_site`	Changes the name, the allowed origins, the difficulty or the automation sensitivity of a site. Only the fields you give change. The origins replace the whole list.
`get_stats`	Totals, failure reasons, daily numbers and your monthly quota for one site.
`verify`	Checks a token, the same as the verify endpoint.

Without a browser

Headless clients send an account API key as Authorization: Bearer sk_live_…. Make one under Settings → API keys. A quick check that lists the tools:

curl -X POST https://bot403.com/mcp \
  -H "Authorization: Bearer sk_live_YOUR_ACCOUNT_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/list"}'

Limits

120 tool calls a minute per token. The tools follow the same plan rules as the API. The OAuth endpoints are listed at /.well-known/oauth-authorization-server.