MCP server

EchoTrail Insights as tools for your agent.

The MCP server exposes the same Windows process behavior data as the REST API through the Model Context Protocol, so Claude, Codex, Cursor, or any MCP client can call it mid-conversation. One config block and one API key, the same key the REST API uses.

Get a free key Full docs

Connect a client

Paste the block, replace YOUR_API_KEY, restart the client. The endpoint is https://api.echotrail.io/mcp.

Claude Code

Add to .mcp.json

{
  "mcpServers": {
    "echotrail": {
      "type": "http",
      "url": "https://api.echotrail.io/mcp",
      "headers": { "Authorization": "Bearer YOUR_API_KEY" }
    }
  }
}

Claude Desktop

Add to claude_desktop_config.json (Settings, Developer, Edit Config; needs Node.js)

{
  "mcpServers": {
    "echotrail": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://api.echotrail.io/mcp", "--header", "Authorization:${AUTH_HEADER}"],
      "env": { "AUTH_HEADER": "Bearer YOUR_API_KEY" }
    }
  }
}

Codex CLI

Add to ~/.codex/config.toml

[mcp_servers.echotrail]
url = "https://api.echotrail.io/mcp"
http_headers = { "Authorization" = "Bearer YOUR_API_KEY" }

Cursor

Add to .cursor/mcp.json

{
  "mcpServers": {
    "echotrail": {
      "url": "https://api.echotrail.io/mcp",
      "headers": { "Authorization": "Bearer YOUR_API_KEY" }
    }
  }
}

Tools

Which tools your key can call depends on the tier. tools/list always shows the set for your key. A tool outside your tier returns an error naming the tier that includes it and a link to pricing.

Free

summary shape

lookup_processSummary for a process: known or not, category, publisher, one line of context, verdict on the usual parent.
check_parent_childWhether a parent-child pair has been observed, and how common it is.

Team and above

full record

lookup_processThe full record: execution count, top parents, children, grandparents, paths, hashes, the lab record, and the written guidance.
lookup_hashSHA-256 or MD5 to the filenames it ran as, with execution counts.
analyze_pathWhether a process has been seen running from a given directory.
get_prevalenceExecution count for a process.
check_process_treeNormalcy of a grandparent, parent, child chain.
analyze_eventComposite event analysis with a 0 to 10 risk score.
search_processesSemantic search across processes in natural language.

An unknown process returns a normal result with known: false and a notify_url, so agents can reason about it. The name is queued for the lab, and POST /v1/notify registers your interest in it.

What it looks like

One question in Claude Desktop with the server connected, on the free tier. The tool result is the actual API response for this pair.

You

Is it normal for winword.exe to spawn cmd.exe?

Claude

calls check_parent_child

{ "parent": "winword.exe", "child": "cmd.exe" }

result

{ "parent": "winword.exe", "child": "cmd.exe", "observed": true, "verdict": "rare", "share_pct": 0.0, "full_record_available": true, "upgrade_url": "https://echotrail.io/pricing/" }

Claude

It has been observed, but rarely: winword.exe accounts for under 0.01% of cmd.exe launches in the dataset. Want the top parents of cmd.exe for comparison?

Quota

Only tools/call counts against your limits. Protocol methods (initialize, ping, tools/list) are free.

Same data, same shapes

Tool results use the REST response shapes: summary on Free, full record on Team. See both shapes.

Start with a free key

No card. Upgrade from the developer dashboard when you need the full record.

Get your API key Read the docs