API & MCP
Mirror Ai MCP reference
Keys, sign-in, limits and fixes. To connect a tool, start with the setup guide.
What you get
MCP is a standard way for an AI assistant to use an outside source of data. Connecting Mirror Ai over MCP lets the assistant you already work in pull Mirror Ai research itself, instead of you copying numbers out of the workspace and pasting them into a chat.
Once connected, your assistant can reach 48 Mirror Ai tools across five areas:
- Market data. Live prices, price history and OHLCV candles.
- DeFi. Protocols and liquidity pools.
- Research. Case files, the evidence behind a finding, pattern analysis and whitepaper research.
- Security. Address reputation, holder analysis, token scans, and your own watchlist and alerts.
- Compliance. Regulatory documents, rules by jurisdiction, jurisdiction scores and regulatory timelines.
Two ways to connect
Your tool decides which way you connect.
Sign in (Claude, ChatGPT, Claude Code)
Add Mirror Ai's address to the tool, then sign in to Mirror Ai in your browser and allow access. There is no key to create, copy or store.
Use an API key (Cursor, VS Code, Windsurf, Codex, scripts; Claude Code also works)
Create a key in your Mirror Ai workspace and paste it into the tool's settings. Use this for tools that cannot sign in, and for your own scripts.
Both ways give your assistant the same 48 tools and the same limits, and both need an active Mirror Ai plan or free trial, or VIP access. You can use both at once, for example ChatGPT signed in on the web and Cursor with a key on your laptop.
Creating a key
Using Claude, ChatGPT or Claude Code? You do not need a key. Those three sign in with your Mirror Ai account.
A key is how your AI tool proves it is you. You make one inside Mirror Ai, in three clicks.
- Open your Mirror Ai workspace and choose API & MCP in the left rail. It is also linked from your profile page.
- Select Create key.
- Give it a name and choose when it expires, then select Create key again.
Name the key after the machine or the tool it is for, so that "Work laptop, Claude Code" tells you what stops working if you ever revoke it. Expiry defaults to 90 days, and 30 days and 365 days are the other two choices.
The key is shown once. It appears in full on that screen and nowhere else, ever again. Copy it into your password manager before you close the panel. If you lose it, you do not recover it, you rotate the key and get a new one.
A Mirror Ai key always begins gl_mcp_ followed by a long random string. In every snippet that key is written as gl_mcp_YOUR_KEY: wherever you see it, paste your own key in its place, including the gl_mcp_ part.
Claude Code with a key
Claude Code normally signs in. For a machine where you would rather not, add your key to the command:
claude mcp add --transport http --scope user mirror https://mcp.mirror.glasslane.io/mcp --header "Authorization: Bearer gl_mcp_YOUR_KEY"This is the same line as the sign-in one with your key added at the end. Use one or the other, not both: while an entry carries a key, Claude Code uses the key and does not offer to sign in.
What signing in looks like
The same few screens appear whichever of the three you use:
- The Mirror Ai sign-in page, if you are not already signed in to Mirror Ai in that browser. Sign in as usual and you are taken straight back to the connection.
- Connect an app to Mirror Ai. This screen names the app, the website that vouches for it, and the Mirror Ai account it will use. It lists what the app can do (read Mirror Ai data, and add to or dismiss items on your own security watchlist and alerts) and what it cannot (use the Mirror Ai AI assistant tools, see your payment details, or keep working if your plan lapses).
- Signed in as the wrong account? Select Not you? Switch Mirror Ai account, sign out, and sign in as the right one. Nothing is connected until you allow it.
- Allow access sends you back to the app, connected. Deny cancels, and nothing is connected.
If the screen says unverified where the website would be, the app registered itself with Mirror Ai and its name has not been checked. Only continue if you started the connection yourself.
You type your password on Mirror Ai's own page, so the app never sees it. What the app receives works only with Mirror Ai's MCP server, renews itself every hour while you use the app, and stops the moment you disconnect the app.
Keeping your key safe
- A key is a password to your Mirror Ai account. Anyone holding it can read everything your plan covers, without your email address or your password.
- Never send it in an email, a chat message or a screenshot. Put it in a password manager, or in the tool's own secret storage, and nowhere else.
- One key per machine. They are free, and separate keys are what lets you turn off a lost laptop without touching anything else.
- Revoking a key affects only that key. Your other keys, your login, and everyone else on your team carry on working. If you think a key has leaked, revoke it immediately and make a new one.
- Disconnect signed-in apps you no longer use. In your workspace, open API & MCP, then Connected apps, and select Disconnect. The app's next call fails, and connecting it again means signing in again. Your keys and your other apps are not affected.
- Only allow access you asked for. Select Allow access only when you started the connection yourself and the app and website on the screen are the ones you meant.
- Leave your tool's approval prompts on. An AI assistant reads web pages, documents and files, and text inside those can carry instructions aimed at the assistant rather than at you. The prompt that asks before a tool runs is what stops that turning into an action on your account.
If something goes wrong
Find what you are seeing. Each one says what is happening and what to do.
Signing in
Claude Code says "Server rejected the configured Authorization header (HTTP 401)"
Why. An older Mirror Ai entry in Claude Code still carries a key, and that key no longer works, usually because it expired or was revoked. While an entry carries a key, Claude Code will not offer to sign in, which is what the end of the message, "OAuth fallback is disabled when headers.Authorization is set", is saying.
Fix. Remove the old entry, add it again without the key, then sign in as in Claude Code:
claude mcp remove "mirror" -s user
claude mcp add --transport http --scope user mirror https://mcp.mirror.glasslane.io/mcp"An active subscription is needed"
Why. Connecting an app needs an active Mirror Ai plan or free trial on the account you signed in with, and that account does not have one. Nothing was connected. It also appears if you signed in with a different account from the one that has the plan. Access through a wallet NFT does not include connecting apps yet.
Fix. Check the plan in your subscription, or sign in with the account that has it. Then go back to the app and start the connection again.
ChatGPT has no Developer mode setting, or no way to add a custom MCP server
Why. Adding Mirror Ai to ChatGPT needs developer mode, and developer mode depends on your ChatGPT plan and, in a workspace, on your admin. It is web only, so the phone apps never show it.
Fix. On the web, look under Settings, Security and login (on some accounts, Settings, Apps, Advanced settings). If the switch is not there, your plan does not include it: a Free plan does not, on Business only admins and owners have it, and on Enterprise and Edu an admin has to grant it. Nothing on the Mirror Ai side changes this. Any tool that uses a key, such as Cursor or VS Code, works in the meantime.
"This connection request has expired", or "has already been answered"
Why. Each sign-in request is good for one answer and for a short time. It expires if the screen was left open too long or an old tab was reopened, and it has already been answered if you went Back, or used a second tab, after selecting Allow access or Deny.
Fix. Go back to the app you were connecting and start again from there. If the app already shows Mirror Ai as connected, there is nothing to do.
An app that was signed in asks you to sign in again
Why. A sign-in renews itself every hour while the app uses Mirror Ai. It ends if the app has not used Mirror Ai for 30 days, or if the app was disconnected under Connected apps.
Fix. Sign in again with the same steps as the first time. In Claude Code that is /mcp, then mirror, then Authenticate.
Signing in takes you to billing: "Your last payment didn't go through"
Why. The last payment on your Mirror Ai plan failed. Until it is fixed, signing in takes you to the subscription section of your profile rather than on to the connection.
Fix. Update your payment method there. Once the payment goes through, use Continue where you left off if your profile page offers it, or go back to the app and start the connection again.
"Temporarily unavailable", "We could not check your subscription" or "Mirror Ai could not record your answer"
Why. Something on the Mirror Ai side did not answer in time. Nothing was connected, and nothing is wrong with your account.
Fix. Wait a moment and select Try again on that page. If it happens again, go back to the app and start the connection again.
Keys and settings files
The tool says the key is invalid, and you are sure you copied it
Why. Almost always a stray space, a line break, or half a key. Copying from a screen rather than with the Copy button often takes a trailing space, and a key that is too short was truncated when it was pasted.
Fix. Check the key in your config starts with gl_mcp_ and is one unbroken run of characters with no spaces and no line break in the middle. Quotation marks around it in JSON are correct and stay. If in doubt, rotate the key in the console and paste the fresh one with the Copy button.
Cursor, VS Code or Windsurf reports an authentication error straight away
Why. Mirror Ai refuses any request that arrives without a key. Tools that can sign in (claude.ai, ChatGPT and Claude Code) take that refusal as the cue to start signing in. A tool set up with a key shows an authentication error instead, and when that happens at once it almost always means the key was not sent at all, because the Authorization line did not survive the paste.
Fix. Check that the line reads "Authorization": "Bearer gl_mcp_...", with the word Bearer, one space, then the key. Missing Bearer, or a missing space after it, produces exactly this.
It worked yesterday and stopped today
Why. The key expired, or it was revoked, or the subscription behind it lapsed. Keys are not revoked when a plan lapses, but every call made with one is refused until the plan is active again.
Fix. Open API & MCP in your workspace and look at the key's status column. Expired or Revoked means make a new key. Active means check your plan on the subscription page; a resumed plan starts working again within about five minutes. For a signed-in app, see "An app that was signed in asks you to sign in again", above.
Windsurf will not connect, and the same settings work elsewhere
Why. Windsurf expects serverUrl where every other tool on this page expects url. A Windsurf entry with url in it is not an error to Windsurf, it is a server with no address, so it fails silently.
Fix. Open mcp_config.json and check the line reads "serverUrl". Copy the Windsurf block rather than adapting another one.
Codex cannot find the key you set
Why. An environment variable belongs to the terminal window it was set in. Codex only sees MIRROR_MCP_KEY if it was started from a window where that variable exists, so setting it in one window and launching Codex from another, or from the Dock or the Start menu, leaves Codex with nothing.
Fix. On a Mac, add the export line to the end of ~/.zshrc, then close every terminal window and open a new one. On Windows, setx already saved it, but only windows opened after that command can see it, so close the window and open a new one.
Any tool
You saved everything and nothing changed
Why. The tool is still running with the settings it read when it started. This is the single most common cause, and it looks exactly like a broken key.
Fix. Quit the application completely, not just the window, and open it again. On a Mac that is Cmd Q; closing the window is not enough. For Claude Code and Codex, close the terminal window and open a new one.
The address is refused, or nothing responds at all
Why. The address is wrong. The most common version of this is dropping the /mcp at the end, which leaves you pointing at the server's front door instead of at the MCP entrance.
Fix. The address is exactly https://mcp.mirror.glasslane.io/mcp. All lower case, https not http, no slash on the end, and /mcp present.
It works at home and not on the office network
Why. Corporate networks commonly block outbound connections to addresses they do not recognise, and an MCP connection is an ordinary outbound HTTPS connection to a domain your IT team has probably never seen.
Fix. Ask your IT team to allow mcp.mirror.glasslane.io on port 443. For keys, that is the whole request. Signing in also opens mirror.glasslane.io in your browser, which is the Mirror Ai site itself.
Still stuck? Contact us with the name of your tool, what you see, and, if you use a key, its first eight characters (gl_mcp_ and one more). Never send the whole key.
Limits
- Requests a minute
- 60
- Requests a day
- 10,000
- Active keys per account
- 20
- Key lifetime
- 30, 90 or 365 days
The two request limits are stamped onto each key when you create it, so a key keeps the limits it was made with. Normal research does not come close to them: one question typically spends between one and five requests.
The cap of 20 counts keys that are still active. A revoked key does not count, so if you reach the limit, revoke one you no longer use and create the new one.
Signed-in apps have the same two request limits, 60 a minute and 10,000 a day, counted separately for each app you connect. They do not count towards the 20 active keys, and there is no lifetime to choose: the sign-in renews itself every hour while the app uses Mirror Ai, and lasts until you disconnect the app or it goes 30 days without using Mirror Ai.
Whichever way you connect, your plan is checked on every call, so a key or an app stops working when a plan lapses and starts again once it is active.
Changelog
- Rebuilt the setup guide around a tool picker with three steps for each tool, and moved keys, limits and troubleshooting to this page. Updated the ChatGPT steps to OpenAI's current screen names.
- Added signing in from claude.ai, ChatGPT and Claude Code, the Connected apps list, and troubleshooting for signing in.
- First published. Covers Claude Code, Codex, Cursor, VS Code and Windsurf.