MCP Overview

The Baselayer MCP server exposes Baselayer's business verification products as tools that an AI assistant can call on your behalf. Connect it once and your assistant can run business searches, screen names against watchlists, verify TINs, pull lien and litigation records, and analyze a business's online presence, all inside a normal conversation.

The server implements the Model Context Protocol (MCP), an open standard supported by Claude, ChatGPT, Cursor, and most other AI clients. Baselayer hosts it as a remote server, so there is nothing to install or run yourself.

Server details

How authentication works

Connect with your Baselayer login through OAuth, or use an existing customer API key if your MCP client supports custom HTTP headers. Both methods use the same server URL and expose the same tools.

OAuth: sign in with Baselayer

When you add the server to an OAuth-capable client, the client discovers Baselayer's login page automatically. Sign in with your Baselayer credentials and approve the consent screen: "Search and verify businesses with Baselayer on your behalf". The client receives an OAuth token; no API key is required.

Every OAuth tool call runs as you, scoped by the same organization membership and role permissions that govern your access in the Baselayer Console.

If you do not have a Baselayer account yet, the login page links to self-serve sign-up.

API key: connect with custom headers

Use an existing Baselayer customer API key with the same access you use for the REST API. No separate MCP key, grant, role, or opt-in is needed. Configure your client's remote MCP connection with:

• Server URL: https://api.baselayer.com/mcp
• Transport: Streamable HTTP
• Custom header: X-API-Key: <your-baselayer-api-key>

Send that header on every request. API keys must go in X-API-Key, rather than a bearer token field. Configure the connection to use the key without OAuth: requests containing both X-API-Key and any Authorization header are rejected, as are duplicate X-API-Key headers.

Tool calls use the key's permissions, grants, and organization/application scope, just as they do on the REST API. Organization keys with explicit grants must include api; exports-only and operator keys cannot use MCP. Keys without explicit organization grants retain their existing API access.

An invalid or revoked key returns a 401 error; an exports-only or operator key returns 403. Key authentication errors do not trigger an OAuth login challenge. Revocation and permission changes take effect on the next request or tool call; work already running is not cancelled.

Organizations and applications

With OAuth

By default, tool calls run in your default organization and its production application. This is the right choice for most users.

If you belong to several organizations, or want to work against a sandbox application, use a client that supports custom request headers:

See Claude + Baselayer for connection instructions.

With an API key

Organization keys are bound to their organization and application, including its sandbox or production environment. Request headers cannot switch an organization key to a different organization or application. To change the environment, use a key for the intended application.

Federation keys retain their federation grants. To target an application, send X-External-ID with the target application's external ID, or send both X-Organization-ID and X-Application-ID. The target must belong to the key's federation, and the key must allow the target's sandbox or production environment.

See Sandbox vs. production environments for how the two environments differ.

Billing

Tools that start a search or verification order the same paid work as the matching REST endpoint, at the same price, and appear in your usage the same way. Read tools (get_*) are free. search_watchlists writes one billable order per watchlist requested, so ask for only the watchlists you need.

Support

Questions or issues connecting? Email [email protected] or check status.baselayer.com.