Back to Blog

AbuseZero MCP server and CLI: protect benefits from your agent

Set up free trial and credit abuse protection from your AI coding agent with the AbuseZero MCP server, or from your terminal and CI with the AbuseZero CLI.

AbuseZero Team
IntegrationFree trial abuseCredit abuse

You probably build with an AI coding agent already. The AbuseZero MCP server lets that agent set up and manage your abuse protection directly: create the benefit, pick a protection level, preview a claim, replay a policy change, investigate a denial. The AbuseZero CLI does the same from your terminal, your scripts and your CI.

Both give you the same actions as the AbuseZero REST API, with the same inputs, the same results and the same permission checks. This guide shows what you can do with each and how to connect them in a couple of minutes.

What your agent can do

TaskAbuseZero MCP server toolAbuseZero CLI command
Create a benefit to protectabusezero_create_benefitabusezero benefits create
List protection levels and policiesabusezero_list_policiesabusezero policies list
Preview a claim before going liveabusezero_preview_evaluationabusezero evaluations preview
Replay a policy change against past trafficabusezero_replay_evaluationsabusezero simulations replay
Look up an evaluation and its reasonabusezero_get_evaluationabusezero evaluations get
Add an allow or block list entryabusezero_add_access_list_entryabusezero access-lists add
List recognized AI agentsabusezero_list_agentsabusezero agents list
Report an outcomeabusezero_report_outcomeabusezero outcomes report

That's a sample. Every action that has an MCP tool also has a CLI command. The coverage table lists them all.

It's also the fastest way to respond when something goes wrong. When a wave of repeat claims hits at 2 a.m., one sentence to your agent can replay the last hour against a stricter protection level and switch the benefit over, without hunting through a dashboard half asleep.

A session with your agent

Protect our Pro trial in observe modeabusezero_list_policiesLenient, Balanced, Strict and your policiesabusezero_create_benefitBenefit created in observe modeabusezero_preview_evaluationallow, with risk score and reasonBenefit ready, here's the evaluate call for your routeYouYour AI coding agentAbuseZero MCP serverYouYour AI coding agentAbuseZero MCP server
Protect ourPro trial inobservemodeabusezero_list_policiesLenient,Balanced,Strict andyourpoliciesabusezero_create_benefitBenefitcreated inobservemodeabusezero_preview_evaluationallow, withrisk scoreandreasonBenefitready,here's theevaluatecall foryour routeYouYour AIcodingagentAbuseZeroMCPserverYouYour AIcodingagentAbuseZeroMCPserver

Prompts that work well:

Create a benefit called "Pro trial" with key pro_trial, Balanced protection,
once per user, in observe mode. Then add the evaluate call to our trial route.
Replay the last week of pro_trial evaluations against the Strict protection level
and tell me which results would change.
Why was evaluation eval_3f6c2a1e-8b4d-4c7a-9e2f-5d1b7a0c4e93 denied?

The AbuseZero MCP server also offers ready-made prompts: review_policy, investigate_denial and simulate_policy_change. None of them changes anything on its own.

Connect the AbuseZero MCP server

Add a remote MCP server with this address. Any client that supports the standard Streamable HTTP transport can connect.

MCP client configuration
{
  "mcpServers": {
    "abusezero": { "url": "https://mcp.abusezero.com/mcp" }
  }
}

Your app opens a browser to sign in to AbuseZero, where you approve the permissions it asks for.

After you sign in, your agent lists your workspaces with abusezero_list_workspaces and picks one with abusezero_select_workspace. The full setup is in AbuseZero MCP server.

MCP access on every plan

The AbuseZero REST API and MCP server come with every plan, Builder included. Start with Builder and connect your agent today.

Built to be safe with an agent

Letting an agent change your abuse protection should feel safe. The AbuseZero MCP server is designed for it:

  • Your permissions, never more. Sign-in uses OAuth. The agent gets only the permissions you approve, still limited by your role in the workspace.
  • Every tool is labeled. Each tool is marked as read-only, changing data or permanent, so your app can ask before it acts.
  • Retries never double up. Every change takes an idempotency key, so a retried call returns the original result instead of repeating the change.
  • You hear about new connections. AbuseZero emails you when you approve a new app, and you can disconnect it at any time in Developers → OAuth apps.
  • Sensitive work stays in the dashboard. API keys, webhook endpoints, billing and team members aren't MCP tools at all.

Previews and evaluations are real and use credits, whichever tool runs them.

Use the AbuseZero CLI in your terminal and CI

npx abusezero --help
abusezero login
abusezero workspaces list --output table
abusezero benefits list

abusezero login opens your browser to sign in. On a machine without a browser, use abusezero login --device. For scripts and CI, create a machine client in Developers → OAuth apps and set its credentials as environment variables:

export ABUSEZERO_CLIENT_ID="…"
export ABUSEZERO_CLIENT_SECRET="…"
abusezero login --machine-client

Machine clients belong to the workspace, so your pipeline keeps working when people join or leave the team. See AbuseZero CLI.

From setup to production

The agent and CLI handle setup and operations. Your application still makes the evaluation call when a user claims a benefit, through the AbuseZero Node.js SDK or the REST API. The full flow is in add a trial and credit abuse check to your signup flow, and the playbooks for AI credits and API free tiers show the settings we'd start with.

Frequently asked questions

What is the AbuseZero MCP server?

It's a remote server that speaks the Model Context Protocol, so AI apps and coding agents can use AbuseZero's actions directly: creating benefits, managing policies and lists, previewing claims, replaying changes and reading evaluations.

Which AI apps work with the AbuseZero MCP server?

Any client that supports the standard Streamable HTTP transport can connect to the remote server. Apps that only start local servers can use npx -y abusezero mcp.

Is it safe to let an agent change my abuse protection?

The agent works with the permissions you approve, limited by your role. Every tool is labeled read-only, changing or permanent, changes are idempotent, and the most sensitive work, such as API keys and billing, isn't available to agents.

Can I use the AbuseZero CLI in CI?

Yes. Create a machine client in Developers → OAuth apps, set ABUSEZERO_CLIENT_ID and ABUSEZERO_CLIENT_SECRET, and every command uses it.

Does the MCP server cost extra?

No. REST API and MCP access come with every plan. Previews and evaluations use credits wherever they run.

Connect your agent

Start with Builder

Pay as you go. MCP access included.

AbuseZero MCP server docs

Connect, authenticate and choose a workspace.

AbuseZero CLI docs

Install, sign in and script every action.

Keep reading