Overview
The Swif MCP server connects AI assistants, such as Claude, ChatGPT, Claude Code, and Codex, to your Swif tenant. It uses the Model Context Protocol (MCP), an open standard for connecting AI apps to tools and data.
Once an assistant is connected, you can ask about your organization's devices, employees, teams, apps, and browser extensions in plain language, and get answers from live Swif data. You can also ask which devices aren't compliant, and why, and get the same verdict the Swif console shows, with steps to fix each device.
Supported AI assistants
Assistant | Status | How to connect |
Claude (web, desktop, and mobile) | Available | |
ChatGPT | Available | |
Claude Code | Available | See Connect from Claude Code below |
Codex | Available | See Connect from Codex below |
Cursor | Coming soon | — |
VS Code | Coming soon | — |
Why only some apps can connect
The Swif MCP server is public, but only approved apps can sign in to it. This stops fake apps from tricking you into entering your Swif API key. Swif adds the apps customers use, so other MCP-compatible apps can't sign in until they're added.
What the server can do
Capability | Details |
List teams, devices, and employees | Filter devices and employees by team, owner, or status |
Check device compliance | Get Swif's official compliance verdict for each device, the reasons a device isn't compliant, and how to fix each one. See Ask about device compliance below. |
See apps and browser extensions | For any device, or find every device with a given app |
Add an employee | Only when you ask, and after the assistant confirms the details with you |
Move an employee to another team | Only when you ask, and after the assistant confirms the details with you |
What it can't do
For your organization's safety, the server can't:
change, lock, or wipe devices
delete employees
change policies or compliance settings. It shows how to fix a device, but you make the change in the Swif console.
Ask about device compliance
The assistant can answer compliance questions with Swif's official verdict, the same one the Swif console shows. It doesn't guess from other details, such as whether a device is encrypted.
What the assistant can tell you
For each device:
Information | Details |
Verdict | Whether the device is compliant |
Reasons | Every reason a device isn't compliant. A non-compliant device always has at least one. |
How to fix it | Steps for each reason, where available |
A device can fail for several kinds of reasons:
Reason | Example |
A built-in policy check failed | The screensaver lock policy isn't on the device. |
A compliance control isn't met | The device doesn't meet your organization's ENC-1 Full-Disk Encryption control. |
A required app is missing | Your organization requires antivirus or a password manager, and the device doesn't have it. Applies only if your organization has turned on these checks, and only to computers, not phones or tablets. |
No compliance status | Swif doesn't have a compliance status for the device yet. |
Fixes the assistant suggests
The assistant shows Swif's steps for each reason, such as:
"Create and assign policy X for this team." The policy doesn't exist yet.
"Assign and deploy team policy X to this device." The policy exists, but isn't on the device.
Specific steps for some policies, for example: "Configure the Windows BitLocker Auto Policy to encrypt the system drive, then assign it to this device."
For compliance controls, the steps can be short labels, such as Fix Policy or Assign Policy. Open the control in the Swif console for details.
The assistant can also spot patterns. For example, if one missing policy makes every Linux device in a team non-compliant, it can point out that creating that policy once fixes all of them.
Why a verdict and a policy check can seem to disagree
A device can be non-compliant even when every policy check passes. For example, its BitLocker policy is deployed, but some settings don't meet your encryption control. The assistant lists the control as the reason.
A device can be compliant even when an encryption policy shows as failing. If the device itself reports that it's encrypted, Swif counts that toward the verdict.
In both cases, the verdict matches the Swif console.
Compliance questions to try
"Which devices aren't compliant, and why?"
"How many devices in the team named exactly 'Engineering' are compliant?"
"Why is Alex's MacBook non-compliant?"
"Is Sam's laptop compliant?"
"Why are the Windows devices failing encryption?"
"Are any devices compliant even though a policy is failing?"
"Which devices across the whole organization aren't compliant?"
For large fleets, the assistant reads every page of results, not just the first.
Compliance covers macOS, Windows, Linux, Android, and iOS/iPadOS devices.
Example questions
Devices and compliance
"List the devices in the Engineering team."
"Which devices aren't compliant, and how do I fix them?"
"Which devices haven't checked in this week?"
Apps and extensions
"Who has Zoom installed?"
"What browser extensions are on Alex's laptop?"
Employees and teams
"List all employees in the team named exactly 'Engineering'."
"Add Jane Doe, jane@example.com, to the Sales team."
Requirements
A Swif UEM account
A Swif API key, created in the Swif admin console. See Public APIs: your API key.
A Claude or ChatGPT plan that supports connectors or apps, or Claude Code or Codex installed
Server details
Item | Details |
Server URL (US) |
|
Server URL (EU) |
|
Protocol | Standard remote MCP over HTTPS |
Sign-in | Standard MCP sign-in (OAuth), with your Swif API key |
For Claude and ChatGPT, you don't need the server URL. Installing Swif from Claude's Connectors Directory or the ChatGPT app listing sets it up for you. For Claude Code and Codex, use the URL for your region in the commands below.
Opening the server URL in a browser shows a Swif page with the URL and a Copy button.
How sign-in works
You add Swif to your AI assistant, from Claude's Connectors Directory, the ChatGPT app listing, or the command line.
The assistant sends you to Swif's sign-in page. You paste your Swif API key there, once.
Swif checks your key and stores it encrypted. The assistant gets only a short-lived token from Swif, never your API key.
Every question after that uses your stored key. You see only your own organization's data.
Your API key is checked, encrypted, and never shown to the AI tool.
Connect from Claude Code
Requirement: Claude Code installed. Check with:
claude --version
Add the Swif server. Use the US URL, or the EU URL if your Swif tenant is in the EU:
claude mcp add --transport http swif https://mcp.swifteam.com/mcp
You should see Added HTTP MCP server swif.
Start Claude Code:
claude
Type
/mcp, select the swif server, and choose Authenticate.A browser opens. Paste your Swif API key, accept the agreement, and approve.
When the browser says you can close the window, return to Claude Code. It shows Authentication successful. Connected to swif.
Ask a question, such as "Which devices aren't compliant, and why?" You stay connected after long breaks, and after quitting and reopening Claude Code.
Switch to another tenant:
claude mcp remove swif
Then add the server again, and authenticate with the other tenant's API key.
Remove Swif from Claude Code:
claude mcp remove swif
Connect from Codex
Requirements: Codex installed and signed in with a ChatGPT account. Check with:
codex --version
Add the Swif server. Use the US URL, or the EU URL if your Swif tenant is in the EU:
codex mcp add swif --url https://mcp.swifteam.com/mcp
A browser opens. Paste your Swif API key, accept the agreement, and approve. The terminal shows Successfully logged in.
Check the connection:
codex mcp list
swif should show as enabled, with OAuth.
Start Codex, and ask a question:
codex
Switch to another tenant:
codex mcp logout swif codex mcp login swif
Then authenticate with the other tenant's API key.
Remove Swif from Codex:
codex mcp remove swif
Security and privacy
Your API key stays with Swif. It's checked, encrypted, and stored by Swif. AI assistants get only a short-lived token.
Only your organization's data. Each connection sees only the tenant its API key belongs to.
Changes need your confirmation. The assistant confirms before adding or moving an employee, and it can't make any device changes.
Revoke access at any time. Disconnect Swif in the AI assistant's settings, or revoke the API key in the Swif admin console to stop all access immediately.
Swif CLI and the MCP page
The MCP page in the Swif console's sidebar is the hub for Swif's command-line and AI integrations. It includes setup for the Swif CLI, and lists upcoming integrations.
Troubleshooting
My AI tool isn't listed as supported
Claude, ChatGPT, Claude Code, and Codex are supported today. Cursor and VS Code are coming soon. Other apps can't sign in until Swif adds them.
Adding the server URL to Cursor or VS Code fails at sign-in
This is expected. Sign-in isn't enabled for these tools yet.
Claude Code doesn't open the browser to sign in
Run claude, type /mcp, select the swif server, and choose Authenticate.
Codex shows Swif, but not as enabled
Run codex mcp login swif and sign in again. Then check with codex mcp list.
Claude Code or Codex says sign-in is needed
The connection was removed or expired. Authenticate again, as in the setup steps.
The sign-in page rejects my API key
Check that you copied the whole key, and that it hasn't been revoked in the Swif admin console. Create a new key if needed.
I'm on the EU region
Use the EU server URL, https://mcp.eu.swifteam.com/mcp, in the Claude Code and Codex commands, or when adding Swif manually to Claude or ChatGPT.
The assistant shows another tenant's data
Each connection uses one API key. Disconnect Swif, then connect again with the correct tenant's API key. In Claude Code and Codex, follow Switch to another tenant above.
A device is non-compliant, but every policy check passes
The device doesn't meet one of your organization's compliance controls, such as ENC-1 Full-Disk Encryption. Ask the assistant why the device isn't compliant. It lists the control, and how to fix it.
A device is compliant, but an encryption policy shows as failing
This can be expected. If the device reports that it's encrypted, Swif counts that toward the verdict, even if the policy check fails.
Missing antivirus or a password manager isn't listed as a reason
These count only if your organization has turned on the antivirus or password manager checks, and only on computers. Check your organization's compliance settings in the Swif console.
A control doesn't appear in the reasons
Controls marked Not Supported for a device in the Swif console aren't counted, so they don't appear as reasons.
Related resources
Swif
Model Context Protocol