> ## Documentation Index > Fetch the complete documentation index at: /docs/llms.txt > Use this file to discover all available pages before exploring further. # Arize AX MCP Server FAQ > Answers to common questions about the Arize AX MCP server: permissions, OAuth or API key, choosing between MCP, Skills, and the CLI, and fixing connection errors. ## General > **Can my agent change or delete data?** > > Yes. The server has tools that create, update, and delete resources, and a call runs as soon as your client sends it. The agent can do whatever your Arize role allows. See [safety and permissions](/docs/api-clients/mcp/overview.md#safety-and-permissions) for how to limit this. > **Does the agent see more than I can?** > > No. The server forwards your credential to the REST API on every call, so the agent sees only what your Arize role allows. > **Should I sign in with OAuth or use an API key?** > > Use OAuth for interactive clients where you sign in as yourself, such as Claude or Codex. Use an API key for scripts, CI, headless agents, and Cursor. See [authentication](/docs/api-clients/mcp/authentication.md). > **Should I use the MCP server, Skills, or the CLI?** > > There are three ways to put Arize AX in front of an agent: > > * The MCP server suits interactive use, where you work with an agent in your editor or a chat client and want it to look things up or make changes as you talk. There is no installation step, and it also works as a connector in clients that support them. > * [Skills](/docs/ax/skills/overview.md) suit repeatable workflows that you want an agent to follow, such as adding tracing to an app, building a dataset, running an experiment, or optimizing a prompt. Skills drive the CLI. > * [The Arize AX CLI](/docs/api-clients/cli/overview.md) suits scripts and CI/CD pipelines, where no agent needs to choose the next step. ## Connecting and troubleshooting For setup steps, see [connect your client](/docs/api-clients/mcp/connect.md). > **The client connects but no tools appear** > > Confirm the transport is Streamable HTTP. A client configured for `stdio` will try to run the URL as a command, and one configured for `sse` will hang on a connection the server does not offer. Set `"type": "http"`, or pass `--transport http` on the Inspector CLI. > **Authorization errors on every call** > > The header must be `Authorization: Bearer `. The `Bearer` prefix is mandatory, and a bare key with no prefix returns `401`. > > If the value looks right, your client probably did not expand `${ARIZE_API_KEY}`. Paste the key directly to confirm, then move it back into an environment variable once the connection works. > **401 for a key that starts with something other than ak-** > > Arize API keys start with `ak-`. The server validates any other bearer token as an OAuth access token, so a key without the prefix is rejected with `401`. Copy a key from **Settings → API Keys** and check that nothing was trimmed. > **A tool returns 404 for a resource I know exists** > > The REST API returns `404` when the caller has no read access, rather than `403`, so that nobody can enumerate resources by probing IDs. A `404` on something you can see in the UI usually means the key lacks read access to that space or project, or belongs to a different region. See [authorization](/docs/ax/rest-reference/overview.md#authorization). > **Requests start failing with 429** > > Rate limits apply per user, so all of your keys share one limit. They are counted per endpoint in a fixed one-minute window. The default is 100 requests per minute. `POST /v2/spans`, `DELETE /v2/spans`, and the annotate endpoints allow 10 per minute. The response includes a `Retry-After` header: wait that long before retrying, and narrow your filters so fewer pages are needed. See [conventions](/docs/api-clients/mcp/conventions.md) and the [REST rate limits](/docs/ax/rest-reference/overview.md#rate-limits). > **A request times out** > > The server waits up to 30 seconds for the upstream REST API on each request. Narrow your filters or request a smaller page, then retry. > **A browser-based client cannot connect** > > The server rejects requests that carry an `Origin` header, which means browser clients are blocked by default, including the Inspector web UI. Use the Inspector CLI described in [verify the connection](/docs/api-clients/mcp/connect.md#verify-the-connection), or a client that runs as a native process. > **A plain GET on the endpoint returns an error** > > Only the `/mcp` prefix is routed publicly, and a bare `GET` or `HEAD` against it returns a protocol error rather than a health signal. To check reachability, make a `tools/list` call.