Connect Claude to INITE Studio

curl -fsSL https://inite.studio/install.sh | sh

Default target: ~/.claude/skills/. Pass --target=project to install into the current repo's .claude/skills/ instead — useful if a project has bespoke prompts.

All skills are plain markdown — read them, edit them, fork them. There is nothing magical. Audit-grade transparency on every step Claude follows.

{
  "mcpServers": {
    "ideaudit": {
      "type": "http",
      "url": "https://api.inite.studio/mcp",
      "headers": { "Authorization": "Bearer YOUR_API_KEY" }
    }
  }
}

Restart Claude Desktop after editing the config. CLI registration takes effect immediately. SDK uses the key per-request.

Each lens (audit-team, audit-market, audit-competition, …) emits two outputs that feed the v2 verdict:

• Pass/fail — boolean, the lens's own rubric.
• Confidence (0..1) — how strongly the lens trusts its conclusion given the evidence it gathered. Low confidence on a fail is a softer signal than high confidence on a fail.

compute_dealbreakers_v2 aggregates these into a four-bucket decision:

Stage matters. The same lens output is weighted differently for an idea-stage founder vs a Series A applicant — a missing CFO is fatal at Series A and ignorable at idea stage. Stage is captured via setAuditStageSector on save.

Cross-lens consensus. When two lenses make contradictory claims (audit-market: “CAGR 30%” vs audit-competition: “saturated, no growth left”), we surface a consensus warning and downgrade the overall confidence. Read the warnings card on the audit detail page or call GET /api/methodology/consensus/:auditId headlessly.

Cohort percentile. If your audit has a sector tag and at least one other audit shares it, we surface where this idea sits in the cohort distribution. GET /api/methodology/cohort/:auditId.

Calibration. The platform tracks outcomes you record and reports whether the score actually predicts funding events. Mean-funded vs mean-killed score, threshold accuracy, and a suggested GO threshold are exposed via GET /api/methodology/calibration. Aim for ≥30 outcomes before treating the discrimination number as load-bearing.

Which skills emit confidence

Lenses report a 0..1 confidence number alongside their pass/fail. The aggregator weights each lens by its confidence before deciding the overall verdict — a high-conviction fail outweighs a low-conviction pass elsewhere. Skills that currently emit confidence:

Headers we send

• Content-Type: application/json
• X-Ideaudit-Event — one of audit.finalized, audit.outcome.recorded, entity.created.
• X-Ideaudit-Signature: sha256=<hex> — see below.
• X-Ideaudit-Endpoint: <uuid> — your endpoint id, for routing on multi-endpoint receivers.

Verifying signatures (Node)

The signature is HMAC-SHA256(secret, raw_request_body) as a hex string, prefixed with sha256=. Verify against the raw bytes of the body — never the re-serialized JSON.

import { createHmac, timingSafeEqual } from 'node:crypto';

export function verify(secret: string, signatureHeader: string, rawBody: string): boolean {
  const expected = 'sha256=' + createHmac('sha256', secret).update(rawBody).digest('hex');
  const a = Buffer.from(signatureHeader);
  const b = Buffer.from(expected);
  if (a.length !== b.length) return false;
  return timingSafeEqual(a, b);
}

Verifying signatures (Python)

import hmac, hashlib

def verify(secret: str, signature_header: str, raw_body: bytes) -> bool:
    expected = "sha256=" + hmac.new(
        secret.encode(), raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature_header)

Test events

The dashboard's “Test” button uses your most recent finalized audit's id (or zero-UUID if you have none) and adds isTest: true to the payload. Branch on it in your receiver to skip side-effects.

Auto-disable

After 5 consecutive non-2xx responses we flip active = false and surface the endpoint with an Auto-disabled badge. Click Re-enable on Settings → Webhooks once you've fixed the receiver. Recent delivery history (status + response body) is shown in an expandable panel per endpoint.

Authenticate as a dashboard user with a Bearer JWT from inite-auth (auth.inite.ai). This endpoint is not on the MCP API-key surface — it sits behind the same auth as the rest of the dashboard. The body bundles the user prompt, the Anthropic API key Claude should spend, and the user's own INITE Studio MCP key so the orchestrator can persist results.

curl -N https://api.inite.studio/api/audit/run \
  -H "Authorization: Bearer $INITE_JWT" \
  -H "Content-Type: application/json" \
  -d '{
    "prompt": "audit this idea: an AI note-taking app for lawyers",
    "anthropicKey": "sk-ant-...",
    "ideauditKey": "ideaudit_...",
    "model": "claude-sonnet-5"
  }'

Stream events

• event: text — Claude's incremental tokens.
• event: tool — when an MCP tool fires ({ toolName, input }).
• event: done — terminal event; payload includes the auditId if the orchestrator called save_audit. Look up the full report at GET /api/audits/<id>.
• event: error — anything thrown server-side. Includes a requestId outside production.