TuringTap

Agent quickstart

This page is written for an AI agent to execute. Follow the steps in order; each step states the output you should see, so verify before moving on. Total time: about two minutes. Full tool reference: SKILL.md.

1. Get an API key (needs the human once)

Ask your human to open turingtap.ai/account#keys, click Create key, and paste you the key. It looks like:

ttk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Treat it like a password: use it only in the MCP config below, never echo it back into the chat afterwards.

2. Add the TuringTap MCP server

Claude Code -- run this one command (substitute the real key):

claude mcp add --transport sse turingtap https://mcp.turingtap.ai/sse \
  --header "Authorization: Bearer ttk_live_xxx"

Any other SSE-capable MCP client -- add this JSON to its MCP config:

{
  "mcpServers": {
    "turingtap": {
      "type": "sse",
      "url": "https://mcp.turingtap.ai/sse",
      "headers": { "Authorization": "Bearer ttk_live_xxx" }
    }
  }
}

Verify: the client lists a connected turingtap server with 8 tools (session_info, get_traffic, analyze, goto, act, ask_human, dismiss_human, notify). A 401 on connect means the key was pasted wrong.

3. Call session_info()

Expect an object shaped like:

{
  "session_id": "sess_...",
  "tier": "free",
  "proxy": { "host": "proxy.turingtap.ai", "port": 8443,
             "token": "<session-token>", "ca_pem": "-----BEGIN CERTIFICATE-----..." },
  "agent": { "online": false, "lan": { "allowed": false, "enabled": false } }
}

agent.online: false is fine for this quickstart -- observe-only needs no desktop agent. Keep proxy.token and proxy.ca_pem for the next step.

4. Route one request through the proxy

Write proxy.ca_pem to a file, then curl through the proxy using proxy.token as the proxy username (password is literally x):

cat > /tmp/turingtap-ca.pem <<'EOF'
<paste the ca_pem value verbatim>
EOF
curl -sS -x "http://<proxy.token>:x@proxy.turingtap.ai:8443" \
     --cacert /tmp/turingtap-ca.pem https://httpbin.org/json

Expect: the normal httpbin JSON body (a slideshow object). A 407 means the token is wrong or the session expired -- call session_info() again. A TLS error means the CA file was mangled -- rewrite it verbatim.

5. Call get_traffic(host="httpbin.org")

Expect the exchange you just made, decrypted:

{
  "exchanges": [ {
    "id": "...", "request": { "method": "GET", "url": "https://httpbin.org/json", "headers": {}, "body": "" },
    "response": { "status": 200, "headers": {}, "body": "{\"slideshow\"..." },
    "timing_ms": 123
  } ],
  "next_cursor": 1,
  "human_active": false
}

An empty exchanges array means step 4 did not go through the proxy -- recheck the -x URL. Pass cursor=next_cursor on later calls to get only new exchanges.

6. Call analyze(host="httpbin.org")

Expect a structural summary (no raw values):

{ "endpoints": [ { "method": "GET", "path_tmpl": "/json", "statuses": [200] } ] }

Setup verified end to end.

Next

  • Point real traffic at the proxy (any HTTP client, test suite, or Playwright) -- see proxy configuration.
  • Read SKILL.md for the workflow patterns and the credential hygiene rules -- mandatory before using get_traffic on authenticated traffic.
  • goto() / act() / ask_human() screencasts need the desktop agent (Personal tier and above for browser driving).