AI agents
Learn how to integrate AI agents with Axiom using Axiom MCP Server or Axiom Skills, and understand when to use each approach.
Axiom provides two complementary approaches for integrating AI agents with your data: Axiom MCP Server and Axiom Skills. Both enable AI agents to query and analyze your Axiom data, but they differ in how they handle credentials, context, and capabilities.
If an agent doesn’t have an Axiom organization to work in yet, it can provision a temporary one itself and hand you a claim link later. For more information, see Agent-created organizations.
Choose between Axiom MCP Server and Axiom Skills
| Aspect | Axiom MCP Server | Axiom Skills |
|---|---|---|
| Credential handling | OAuth-based isolation—agents never see tokens | Requires configured API tokens |
| Context usage | Tool definitions loaded upfront | On-demand loading, lower context overhead |
| Capabilities | Curated, read-only operations | Flexible, extensible beyond curated tools |
| Methodology | Query execution only | Includes investigation methodology and memory |
| Setup complexity | Browser-based OAuth flow | Manual token configuration |
When to use Axiom MCP Server
Consider Axiom MCP Server when:
- You want curated, read-only operations with no risk of destructive actions.
- You prefer OAuth-based credential isolation where agents never see tokens.
- You're comfortable with the context overhead MCP introduces when tool definitions are loaded upfront.
When to use Axiom Skills
Consider Axiom Skills when:
- You want lower context usage and on-demand loading of capabilities.
- You need flexibility beyond the curated Axiom MCP Server tool set.
- You want structured investigation methodology alongside data access.
- You're comfortable configuring properly scoped tokens.
Use both Axiom MCP Server and Axiom Skills
Axiom Skills can complement Axiom MCP Server by providing investigation methodology, memory systems, and APL guidance without duplicating the query interface. Configure your agent to:
- Use Axiom MCP Server for executing Axiom queries.
- Use Axiom Skills for structured investigation methodology and learning from past incidents.
This approach gives you the security benefits of Axiom MCP Server's credential isolation while gaining the systematic debugging capabilities of Axiom Skills.
Token hygiene for AI agents
- Create a new API token specifically for the AI agent. This limits the blast radius if the token is compromised.
- Never use personal access tokens for AI agent use. Personal access tokens have full control over your Axiom account.
- Select only the minimum permissions needed for the agent to perform its tasks:
- Grant query permission on specific datasets the agent needs to access.
- Avoid ingest permissions unless explicitly required. If the agent needs to ingest data, scope the token to the specific datasets.
- Never grant delete, admin, or organization-level permissions.
- Set a short expiry for the token (hours or days rather than months).
- Set query cost limits on the token. A capped token bounds your worst-case query costs in advance, no matter how many queries the agent runs.
- Rotate tokens regularly as part of your security practices.
Query cost limits also cover the remote Axiom MCP Server: its OAuth sessions act as your user account, so limits on your roles cap what agents can spend on your behalf. For more information, see Set query cost limits for AI agents.