# MCP Quickstart
URL: https://docs.autociso.io/developers/mcp/quickstart/
Description: Get a token and make your first AutoCISO MCP call.

This guide gets you from zero to your first AutoCISO MCP call. We'll fetch your **posture summary** — a single call that returns data even for a fresh org.

## Step 1 — Get a token

1. Open **user menu → API Tokens** (the user menu is your name at the bottom of the sidebar; the screen is described in the [API Tokens console reference](https://docs.autociso.io/console/settings/api-tokens/)).
2. Click **Create Token**.
3. Enter a name, for example `mcp-quickstart`.
4. Pick the **MCP Read** scope.
5. Choose **Expires**.
6. Click **Create Token** and copy the token from the **Token Created** dialog. It is shown once.

[MCP Auth and Scopes](https://docs.autociso.io/developers/mcp/authentication/) covers the MCP scopes and org binding; [API tokens](https://docs.autociso.io/developers/api-tokens/) covers expiry, rotation and revocation. Set the token as an environment variable so you never hard-code it:

```bash
export AUTOCISO_MCP_TOKEN="aci_REPLACE_ME"
```

## Step 2 — Make your first call

The MCP endpoint is `https://api.autociso.io/mcp`. Authenticate with a bearer token. Here is the same `posture_summary` call three ways:

**cURL**

```bash
curl -s \
  -H "Authorization: Bearer $AUTOCISO_MCP_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"posture_summary","arguments":{}}}' \
  "https://api.autociso.io/mcp"
```

**TypeScript**

```typescript
const client = new AutocisoMcpClient({
  baseUrl: 'https://api.autociso.io/mcp',
  token:   process.env.AUTOCISO_MCP_TOKEN!,
});

const posture = await client.posture.summary();
console.log(posture);
```

**Python**

```python
from autociso_mcp import AutocisoMcpClient

client = AutocisoMcpClient(
    base_url="https://api.autociso.io/mcp",
    token=os.environ["AUTOCISO_MCP_TOKEN"],
)

posture = client.posture.summary()
print(posture)
```

## A successful response looks like

Results are PII-masked — emails appear as `a***@domain.com` and personal names are redacted (to resolve an ID to a name, see [Employee identity](https://docs.autociso.io/developers/employee-identity/)):

```json
{
  "overallScore": 72,
  "staleAccounts": 14,
  "openRisks": 6,
  "isoGapsOpen": 23,
  "topConcern": "14 stale accounts pending review",
  "generatedAt": "2026-06-20T09:00:00Z"
}
```

**Warning — Rate limits**

Requests are rate-limited per token and per org. A `429` carries a `Retry-After` header; the SDKs back off automatically. See [MCP Errors and Retries](https://docs.autociso.io/developers/mcp/errors/) and [Errors & rate limits](https://docs.autociso.io/developers/errors-and-limits/).

## Next steps

- [What you can ask over MCP](https://docs.autociso.io/developers/mcp/capabilities/)
- [Connect Claude Desktop](https://docs.autociso.io/developers/mcp/claude-desktop/)
- [Connect Cursor and VS Code](https://docs.autociso.io/developers/mcp/cursor-vscode/)
- [MCP TypeScript SDK](https://docs.autociso.io/developers/mcp/typescript-sdk/) · [MCP Python SDK](https://docs.autociso.io/developers/mcp/python-sdk/)
- [Browse all 66 tools](https://docs.autociso.io/developers/mcp/tools/)
- [MCP Troubleshooting](https://docs.autociso.io/developers/mcp/troubleshooting/) if the first call fails