MCP · Setup guide

Connect Corexi to your IDE via MCP

The Corexi MCP server gives any Model Context Protocol-compatible AI agent — Cursor, Claude Code, Windsurf, Replit, VS Code — direct access to your UX scans, findings and fix-ready code, without leaving the editor.

You need a Corexi account

Sign up to generate an API key

Corexi is in open beta. Sign up free and you're in immediately — no approval queue. Create your first MCP key in under a minute.

Get MCP access →Already have an account? Log in

Generate an API key

Open Corexi → Settings → API Keys → click New API key. Give it a memorable name (e.g. “Cursor on laptop”), then copy the key from the reveal modal. It's only shown once.

Keys start with crxi_live_. We store only a salted SHA-256 hash; if you lose a key you must revoke and re-issue.

Scopes

mcp:readGranted by default. Lets the agent read sites, scans, findings and UX rules, and run review_code / review_screenshot.

scan:triggerOpt-in. Lets the agent kick off production scans via trigger_scan (counts against your monthly scan quota). Tick the box when you create the key.

Add Corexi to your IDE

Replace crxi_live_YOUR_KEY_HERE with the key you just generated.

CursorRecommended.cursor/mcp.json

{
  "mcpServers": {
    "corexi": {
      "url": "https://corexi.ai/api/mcp",
      "headers": {
        "Authorization": "Bearer crxi_live_YOUR_KEY_HERE"
      }
    }
  }
}

Create the file in your project root, or in ~/.cursor/mcp.json for global access. Cursor reloads MCP servers automatically when the file changes.

Check it connected

Ask your agent to list my Corexi sites. Then open Settings → API Keys: the key's Last used column fills in on the first request that reaches Corexi. An IDE that says “connected” while Last used still says Never is not sending the key.

In a GUI client (MCP Inspector, a server manager with an “Edit server” form), the URL alone is not enough: find the headers or authentication field and add Authorization: Bearer crxi_live_…. Without it the server answers 401 and the client shows the server as disconnected or asks for nothing at all.

Tools your agent can call

Once connected, your agent calls these on its own when you ask UX-related questions. You don't invoke them manually.

Build-time toolsNo scan needed

get_ux_rulesNo scan

Returns Corexi's research-backed UX rules. Filter by category, severity, finding type or free text.

Try asking

"What are the rules for designing accessible CTAs?"

get_ux_checklistNo scan

Returns a pre-flight checklist for a specific surface (checkout, modal, hero, pricing, navigation…).

Try asking

"Give me the checklist before I implement the checkout form."

review_codeopen beta · token

LLM review of a snippet against Corexi's 11-category methodology. Pass site_id to inject your design tokens.

Try asking

"Review this checkout button JSX before I commit."

review_screenshotShared quota

Vision-LLM review of a mockup, Figma export or local screenshot. Validates designs at mockup stage.

Try asking

"Review this Figma export of the new pricing page."

Post-deploy toolsRequires registered site

list_sites

List the sites registered to your Corexi account.

Try asking

"What Corexi sites do I have?"

get_latest_scan

Fetch the latest scan summary for a site — score, category breakdown, pages, timestamp.

Try asking

"What's the UX Score on my pricing page?"

get_findings

List prioritized findings for a scan, filterable by severity and status.

Try asking

"Show me the top 5 high-severity issues on my homepage."

trigger_scanscan scope

Kick off a full UX scan on a site you own, from the IDE. Subject to plan limits + cooldowns.

Try asking

"Scan corexi.ai and tell me what changed since last week."

Rate limits & security

60 requests/minute sustained, 10 requests/second burst per key. Exceeding returns 429 with a Retry-After header.

All tool calls are scoped to the key's owner; your key cannot read another account's data.

Revoke a key any time from Settings → API Keys. Revoked keys fail with 401 immediately.

We log last_used_at for each key (no payloads). Use it to detect stale or unused keys.

Troubleshooting

401 Unauthorized+

Your key is missing, malformed, or revoked. Double-check the Authorization header includes the literal word "Bearer" before your key. Generate a new key in Settings → API Keys if needed.

VS Code asks me to sign in (OAuth) or opens a browser+

VS Code starts an OAuth flow whenever the server answers 401, and Corexi has no OAuth: the key in your mcp.json is wrong, revoked, or from before you regenerated it. Paste the current key into the Authorization header, then restart the server from the MCP view. Each key is shown once; if you revoked it, use the new one.

list_sites shows some of my products but not others+

It lists the products you own and every product a team seat shares with you, the same as the dashboard. If a product is missing, the owner has not added you to their team yet.

429 Too Many Requests+

You hit the rate limit (60 req/min sustained or 10 req/s burst). The Retry-After header tells you when to retry. Spread out tool calls or upgrade your plan.

Tool calls return "Site not found"+

Use list_sites first to get a valid site_id. Sites are scoped to your account; you can only access ones you registered in Corexi.

Cursor doesn't show Corexi in the MCP panel+

Check Cursor settings → Tools and Integrations → MCP. If Corexi shows red, click it for the error log. Most often: malformed JSON or a missing trailing comma in mcp.json.

I lost my key+

Keys are unrecoverable by design; only a salted hash is stored. Revoke the lost key and generate a new one in Settings → API Keys.

What's next

Coming next: a dedicated dashboard panel for MCP usage analytics + IDE connection status, async scan polling for long-running jobs, and a marketplace listing in Cursor. Need something specific? Get in touch.