Query your fleet from an AI assistant with ET Ducky's MCP server

ET Ducky has a read-only API and an MCP server, as of October 16, 2026. An AI assistant that speaks the Model Context Protocol (MCP) can read your agents, alerts, and fleet summary, and an outside dashboard or script can read the same data over REST. Both use one organization API token, and nothing on either surface changes data.

What it reads

The REST API lives under /api/v1 with four endpoints.

• GET /api/v1/agents lists the organization's agents, filtered by hostname, OS, online state, or tag.
• GET /api/v1/agents/{agentId} returns one agent with its latest health sample (CPU, memory, free space on C:, uptime, and pending reboot) and its number of active alerts.
• GET /api/v1/alerts lists alerts newest first, filtered by status, severity, agent, and how many hours back to look.
• GET /api/v1/summary returns agent counts by state and OS and active alerts by severity.

The MCP endpoint at /api/mcp offers the same reads as four tools marked read-only (list_agents, get_agent, list_alerts, and get_fleet_summary). Each tool returns the same JSON as its REST endpoint.

Create a token

Open Team > Workspace > API Tokens in the dashboard. Organization admins and owners can create and revoke tokens there, and so can members holding the API editor privilege.

Give the token a name of 1 to 100 characters, such as the dashboard or script that will use it, then pick an expiry of 30 days, 90 days, 1 year, or never. The token is shown once, starting with etd_api_. Copy it before you select Done, because only a hash of it is stored.

Give each integration its own token and set an expiry where the integration allows it. A token reads every agent's hostname, OS, last signed-in user, isolation state, and alerts for its organization, so store it as you would a password. Revoking a token stops it on its next request, and creating or revoking one is recorded in the audit log.

Connect an AI assistant

Any MCP client that supports the Streamable HTTP transport and lets you set a request header can connect. In Claude Code, add the server with one command.

claude mcp add --transport http etducky https://<workspace>.etducky.com/api/mcp \
  --header "Authorization: Bearer etd_api_..."

Add --scope user to make the server available in every project. To share it through a project's .mcp.json without writing the token into the file, reference an environment variable.

{
  "mcpServers": {
    "etducky": {
      "type": "http",
      "url": "https://<workspace>.etducky.com/api/mcp",
      "headers": {
        "Authorization": "Bearer ${ETDUCKY_API_TOKEN}"
      }
    }
  }
}

Cursor reads the same shape from ~/.cursor/mcp.json or .cursor/mcp.json in one project, with ${env:ETDUCKY_API_TOKEN} for the variable. Once it's connected, ask the assistant which Windows agents are offline, or which critical alerts were raised in the last 24 hours, and it calls the matching tool.

Read it from a script or dashboard

Send the token in the Authorization header on every request. This lists the Windows agents that haven't sent a heartbeat in the last 5 minutes.

curl -H "Authorization: Bearer etd_api_..." \
  "https://<workspace>.etducky.com/api/v1/agents?os=windows&online=false"

Responses are JSON with camelCase field names and UTC timestamps. List endpoints return 100 items by default and 500 at most, with a total count and a truncated flag when the limit cut the list short.

Limits

Each token can make 120 requests a minute across both surfaces, and each client address 600. A request over either limit is answered 429 with a Retry-After header, and requests are not queued.

The MCP endpoint takes the token as a header, but OAuth isn't offered yet. Clients that connect to remote servers only through OAuth, including custom connectors in Claude Desktop and on claude.ai, can't connect yet.

A request that carries an Origin header is refused, so a web page in a browser can't call the endpoint. A Local-First instance serves the same API and MCP endpoint at its own address, with tokens created in its own dashboard.

The full reference, with every field, filter, and error, is in the Public API and MCP Server documentation.