MCP endpoint for service account reviews

Set up

1. Sign up or log in and open Agent Setup in the app.
2. Generate a token. It is shown once, and only its hash is stored. Each token belongs to one workspace and can be revoked.
3. Add the server to your MCP client with the token in the Authorization header.

{
  "mcpServers": {
    "the-it-lead": {
      "url": "https://theitlead.com/api/mcp",
      "headers": { "Authorization": "Bearer <YOUR_TOKEN>" }
    }
  }
}

The client must support custom Authorization headers, as Claude Code and Cursor do. OAuth sign-in is not supported, so hosted chat apps that require OAuth cannot connect. To test the connection from a terminal:

curl -X POST https://theitlead.com/api/mcp \
  -H "Authorization: Bearer <YOUR_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Tools

list_service_accounts

List accounts in the workspace, filtered by status or source system.

get_service_account_record

Read one account with owner, purpose and review dates.

list_owner_review_gaps

Find accounts with no owner email or with a missing or due review. Optional filter for privileged accounts.

get_attestation_history

Read all owner answers and reviewer decisions for one account.

export_review_summary

Read totals and per-account status for one campaign.

draft_owner_followups

Return draft reminder text for owners who have not answered. Nothing is sent.

create_owner_review_campaign

Create a draft campaign for chosen accounts. A person must publish it in the web app.

Access and limits

Every call is scoped to the workspace of the token. Read tools return data only from that workspace. The one write tool creates a draft campaign and cannot send email. Draft campaigns created through MCP are written to the activity log with the channel set to MCP. The endpoint works while the workspace has an active subscription.