# AI Agent & MCP Interface | Aevum Security

Source: https://aevumsecurity.com.sg/agents/

> Connect ChatGPT, Claude or any MCP client to Aevum Security. Public MCP server, OpenAPI and agent manifests for our Singapore cybersecurity services — with signed requests, receipts and a zero-side-effect sandbox.

Sections: Use Aevum Security from AI Agents · What this is · Connect in under a minute · The three tools · Authentication, and the one limitation worth knowing · How we keep an agent surface trustworthy · Machine-readable endpoints · Questions, keys and support

AI Agent MCP Interface | Aevum Security Aevum Security Home Solutions Contact Us Home Solutions Contact Us AI Agent Access Use Aevum Security from AI Agents Aevum Security runs a public MCP server so ChatGPT, Claude and any other AI agent can read our cybersecurity service catalogue and raise a business enquiry — with signed requests, verifiable receipts and a zero-side-effect sandbox. What this is Most of this website is written for people. This page is the front door for the other kind of visitor: an AI agent acting on someone's behalf. Instead of asking a language model to scrape our marketing pages and guess, we publish a proper machine interface. An agent can ask which cybersecurity services we offer, pull the full detail of any one of them, and — with a key and its principal's consent — send us a real business enquiry. Every answer comes from the same source of truth this website is built from, so an agent never quotes a stale page. The interface speaks the Model Context Protocol (MCP), the standard ChatGPT and Claude both use for connecting to external tools. The same three capabilities are also available as a plain REST API described by OpenAPI, for agents and integrations that do not speak MCP. Connect in under a minute The MCP endpoint is: https://agents.aevumsecurity.com.sg/mcp It is a streamable-HTTP MCP server. The two read-only tools work with no credentials at all — paste the URL into your client and start asking. Claude Code claude mcp add --transport http aevum-security https://agents.aevumsecurity.com.sg/mcp Claude (web, Desktop) Settings → Connectors → Add custom connector → paste https://agents.aevumsecurity.com.sg/mcp . ChatGPT (developer mode) Settings → Security and login → turn on Developer mode . Then open the connector list, add a connector and paste https://agents.aevumsecurity.com.sg/mcp . OpenAI API / Playground curl https://api.openai.com/v1/responses \ -H "Authorization: Bearer $OPENAI_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "model": "gpt-5", "tools": [{ "type": "mcp", "server_label": "aevum_security", "server_url": "https://agents.aevumsecurity.com.sg/mcp", "require_approval": "never" }], "input": "Which cybersecurity services does Aevum Security offer?" }' Any other MCP client { "mcpServers": { "aevum-security": { "type": "http", "url": "https://agents.aevumsecurity.com.sg/mcp" } } } Transport note. /mcp is JSON-RPC over HTTP POST only. A GET returns 405 with a pointer to the protocol — that is correct MCP behaviour, not an outage. If you want something readable in a browser, start at the agent surface home page or the llms.txt . The three tools Tool Access What it does list_services Read · no key Lists Aevum Security's cybersecurity services — slug, name and a one-line summary. Use the slug with the other two tools. get_service_details Read · no key Full details of one service, by slug: cyberpatch , cybermonitor , cyberbaseline or cyberforensic . submit_enquiry Write · bearer key Sends a business enquiry to Aevum Security on behalf of your principal. This creates a real enquiry that a human reads and answers within one business day — only call it with the principal's consent. Returns an enquiry id and a signed receipt. A read-only test sequence Anything below works anonymously and changes nothing: # 1. what tools exist curl -sX POST https://agents.aevumsecurity.com.sg/mcp \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' # 2. the service catalogue, over plain REST curl -sX POST https://agents.aevumsecurity.com.sg/actions/list_services -d '{}' # 3. one service in full curl -sX POST https://agents.aevumsecurity.com.sg/actions/get_service_details \ -H 'Content-Type: application/json' -d '{"service":"cyberpatch"}' Authentication, and the one limitation worth knowing Read tools need nothing. list_services and get_service_details are genuinely public — no key, no OAuth, no sign-up. submit_enquiry needs a bearer agent key , sent as Authorization: Bearer key on the HTTP connection. Request one at enquiries@aevumsecurity.com.sg . Be aware: some AI clients — ChatGPT's directory connectors among them — cannot pass a custom bearer key to an MCP server. In those clients the two read tools work fine and submit_enquiry will return an authentication error. That is a limitation of the client, not a fault in your setup. Claude Code, the OpenAI API, and any self-configured MCP client can all send the header. If you cannot, just use the contact form — it reaches the same inbox. How we keep an agent surface trustworthy An API that a machine can call on someone else's behalf needs more than an API key. We are a security company; this surface is built the way we would want a vendor's to be built. Rehearse before you commit. A full sandbox honours the identical contracts with zero side effects. Prove your integration there first — prefix a path with /sandbox or send B2A-Environment: sandbox . Every mutation returns a signed receipt. Ed25519, verifiable by anyone against our published public keys . "The agent says it sent an enquiry" becomes "here is proof it did", at /receipts/{id} . Retries are safe. Mutations are idempotent: send an Idempotency-Key , or rely on input-hash dedup — a retried call replays the original result instead of raising a second enquiry. Signed agent identity is welcome. Requests carrying RFC 9421 HTTP Message Signatures / Web Bot Auth are verified and recorded. It is advisory — never required — but a signed agent is a distinguishable one. The surface is versioned and diffable. Every published surface carries a content hash and a version; the changelog tells a returning agent exactly what moved since its last visit. Machine-readable endpoints Everything below is a plain GET . The manifest is the one to start from — it lists every other endpoint. Agent manifest — start here /.well-known/b2a.json — the canonical endpoint map, capabilities and auth pos…