Skip to main content

See Corexi run on your own product, live, in 15 minutes.

Book a demo
MCP · setup guide

Connect Corexi to your IDE.

The Corexi MCP server gives any Model Context Protocol agent (Cursor, Claude Code, Windsurf, Replit, VS Code) your runs, findings and fix-ready code, without leaving the editor.

Corexi is in open beta: sign up free and create your first key in under a minute.

1

Generate an API key

Open Corexi → Settings → API keys → New API key. Give it a name you will recognise (“Cursor on laptop”), then copy the key. It is shown once.

Keys start with crxi_live_. We store only a salted SHA-256 hash; a lost key is revoked and re-issued.

Scopes
  • mcp:readOn by default. Reads products, runs, findings and UX rules, and runs review_code and review_screenshot.
  • scan:triggerOpt-in. Lets the agent start Autopilot runs with trigger_scan, counted against your monthly quota. Tick the box when you create the key.
2

Add Corexi to your IDE

Replace crxi_live_YOUR_KEY_HERE with the key you just generated.

CursorRecommended
{
  "mcpServers": {
    "corexi": {
      "url": "https://corexi.ai/api/mcp",
      "headers": {
        "Authorization": "Bearer crxi_live_YOUR_KEY_HERE"
      }
    }
  }
}

Create the file in your project root, or in ~/.cursor/mcp.json for global access. Cursor reloads MCP servers automatically when the file changes.

3

Check it connected

Ask your agent to list my Corexi sites. Then open Settings → API keys: the key's Last used column fills in on the first request that reaches Corexi. An IDE that says “connected” while Last used still says Never is not sending the key.

In a GUI client (MCP Inspector, a server manager with an “Edit server” form) the URL alone is not enough: add Authorization: Bearer crxi_live_… in its headers field. Without it the server answers 401 and the client shows it as disconnected.

4

Tools your agent can call

Once connected, your agent calls these on its own when you ask about UX. You do not invoke them by hand.

Build time
no run needed
  • get_ux_rulesNo scan

    Returns Corexi's research-backed UX rules. Filter by category, severity, finding type or free text.

    "What are the rules for designing accessible CTAs?"

  • get_ux_checklistNo scan

    Returns a pre-flight checklist for a specific surface (checkout, modal, hero, pricing, navigation…).

    "Give me the checklist before I implement the checkout form."

  • review_codeopen beta · token

    LLM review of a snippet against Corexi's 9 categories and the neurodiversity lenses. Pass site_id to inject your design tokens.

    "Review this checkout button JSX before I commit."

  • review_screenshotShared quota

    Vision-LLM review of a mockup, Figma export or local screenshot. Validates designs at mockup stage.

    "Review this Figma export of the new pricing page."

After deploy
needs a registered product
  • list_sites

    List the sites registered to your Corexi account.

    "What Corexi sites do I have?"

  • get_latest_scan

    Fetch the latest scan summary for a site — score, category breakdown, pages, timestamp.

    "What's the UX Score on my pricing page?"

  • get_findings

    List prioritized findings for a scan, filterable by severity and status.

    "Show me the top 5 high-severity issues on my homepage."

  • trigger_scanscan scope

    Start an Autopilot run on a product you own, from the IDE. It returns a job id straight away. Subject to plan limits and cooldowns.

    "Run Autopilot on my app."

  • get_scan_job

    Follow a run started with trigger_scan: its steps as they happen, or wait for the end, without blocking the IDE.

    "Is the run done yet?"

  • get_run_diff

    What a run changed against the one before it: fixed, new, back, not seen, still open. Use it after a deploy.

    "What did the last deploy fix?"

Rate limits and security

  • 60 requests a minute sustained, 10 a second burst, per key. Past that you get 429 with a Retry-After header.
  • Every call is scoped to the key's owner; a key cannot read another account's data.
  • Revoke a key any time in Settings → API keys. Revoked keys fail with 401 at once.
  • We log last_used_at for each key (no payloads), so stale keys are easy to spot.

Troubleshooting

401 Unauthorized
Your key is missing, malformed, or revoked. Double-check the Authorization header includes the literal word "Bearer" before your key. Generate a new key in Settings → API Keys if needed.
VS Code asks me to sign in (OAuth) or opens a browser
VS Code starts an OAuth flow whenever the server answers 401, and Corexi has no OAuth: the key in your mcp.json is wrong, revoked, or from before you regenerated it. Paste the current key into the Authorization header, then restart the server from the MCP view. Each key is shown once; if you revoked it, use the new one.
list_sites shows some of my products but not others
It lists the products you own and every product a team seat shares with you, the same as the dashboard. If a product is missing, the owner has not added you to their team yet.
429 Too Many Requests
You hit the rate limit (60 req/min sustained or 10 req/s burst). The Retry-After header tells you when to retry. Spread out tool calls or upgrade your plan.
Tool calls return "Site not found"
Use list_sites first to get a valid site_id. Sites are scoped to your account; you can only access ones you registered in Corexi.
Cursor doesn't show Corexi in the MCP panel
Check Cursor settings → Tools and Integrations → MCP. If Corexi shows red, click it for the error log. Most often: malformed JSON or a missing trailing comma in mcp.json.
I lost my key
Keys are unrecoverable by design; only a salted hash is stored. Revoke the lost key and generate a new one in Settings → API Keys.

Next: a listing in the Cursor Marketplace, alongside cursor.directory. Need something specific? Get in touch.