Authentication

There is no account to sign in to and no session to keep alive. A scan needs two things: an app id naming what to scan, and an app key naming who is scanning. Provide both in your client configuration under env, or set them in your shell so the server inherits them when the client launches it.

This matters more for an MCP server than for a terminal. The server is started by your client, not by you, so there is nobody present to answer a prompt. Credentials have to be there before it runs.

Create a key

Create one under Developer Settings, then API keys. The label you give it is recorded against every scan the key runs, so name it after the thing that will use it — claude-code, cursor-laptop. Months later that label is how you tell an agent's scan from a CI run.

In your client configuration

The most reliable option, because the credentials travel with the server definition rather than depending on the environment the client happened to start in:

{  "mcpServers": {    "sentrasec": {      "command": "sentrasec",      "args": ["mcp", "serve"],      "env": {        "SENTRASEC_APP_ID": "app_...",        "SENTRASEC_APP_KEY": "sk_prod_..."      }    }  }}

From your shell

If the client inherits your shell environment, exporting both is enough and keeps them out of a config file:

$ export SENTRASEC_APP_ID=app_...$ export SENTRASEC_APP_KEY=sk_prod_...

An agent can also pass app_id and app_key per tool call, which is how one session works across several apps.

Verify

Confirm the credentials work before wiring them into a client:

$ sentrasec scan list

Treat the key like any other credential. Keep it out of version control, and rotate it if it is ever exposed.

Once authenticated, connect a client and see the available tools.