Get started

Get started

MCP self-serve eval

Mask prompts and enforce MCP tool calls in Cursor, Claude Code, or VS Code — cloud policy live in under 30 minutes, no platform eval required.

View as Markdown
Get started freeView on GitHubAll supported clients →

Connect in minutes

# .cursor/mcp.json
{
  "mcpServers": {
    "blekline": {
      "command": "npx",
      "args": ["-y", "@blekline/mcp-server"],
      "env": {
        "BLEKLINE_WORKSPACE_TOKEN": "blw_...",
        "BLEKLINE_API_URL": "https://app.blekline.com",
        "BLEKLINE_CLIENT_SURFACE": "cursor"
      }
    }
  }
}

Eval tracks

Track 0

NHIM audit

npx @blekline/nhim-audit audit --plain --json

Track 01

Kubernetes fleet

helm upgrade --install sidecar blekline-ingress -n blekline

Track 02

Docker sidecar

docker pull ghcr.io/blekline/sidecar:0.2.0-nhim

Track 03

MCP self-serve

npx -y @blekline/mcp-server

Track 03 is the fastest path to governed agents: one MCP server between your IDE and every downstream tool. Blekline masks secrets and PII before they leave your machine, evaluates each tool call against workspace policy, and streams metadata-only audit events to your Blekline workspace.

No sidecar required. No cluster access. Ship one workflow this week.

What you prove

  • Prompts are masked before they reach model APIs
  • Tool calls receive allow · mask · block decisions before execution
  • Governance events appear in Operations → Activity
  • Policy updates apply without redeploying local MCP config

Prerequisites

  1. A Blekline workspace — sign up (path chooser defaults to self-serve MCP)
  2. An API key with mask:write and events:write scopes (Admin → API keys or Operations → MCP)

Verify in the workspace

After connecting your client:

  1. Open Operations → MCP in app.blekline.com
  2. Run the live MCP connectivity test
  3. Confirm blekline_mask_prompt and blekline_evaluate_tool_call respond
  4. Trigger a sample tool call from your IDE — check Activity for the allow/mask/block record

Downstream MCP servers

Route existing MCP servers through @blekline/mcp-proxy — Blekline evaluates every forwarded call with the same policy semantics.

→ [MCP proxy guide](/docs/mcp/proxy) · MCP server reference

Client-specific guides

ClientGuide
CursorCursor MCP setup
Claude CodeClaude Code setup
Claude DesktopClaude Desktop
GitHub Copilot / VS CodeCopilot
ContinueContinue

Full matrix: Agent clients hub

Headless verify (CI)

git clone https://github.com/Blekline/blekline-oss.git && cd blekline-oss
pnpm install && pnpm build:packages
export BLEKLINE_WORKSPACE_TOKEN="blw_..." BLEKLINE_API_URL="https://app.blekline.com"
pnpm verify:integrations

→ CI/CD integration

When to upgrade to platform eval

Need Trust Vault tokenization in VPC, Lineage Firewall session blocking, or fleet-wide policy SSE? Move to Kubernetes fleet or Docker sidecar after optional [NHIM audit](/docs/get-started/nhim-audit-quickstart).

Try the simulator: [Runtime Enforcement Simulator](/docs/playground/runtime-enforcement) · [Eval journey overview](/docs/get-started/eval-journey)