Norma can talk directly to your local AI editor — Cursor, Claude Code, VS Code, Lovable, Replit, or any MCP-compatible client — through the Model Context Protocol (MCP). Once connected, your editor works with your governance rules already in context, so the code your AI writes follows them from the first line.

What it does #

Connecting your editor to Norma gives your AI assistant three things:

• It knows your rules. Your editor fetches the governance rules for your project’s detected stack, so it writes code that won’t trigger a new finding on your next scan.
• It checks as you write. Your editor can validate the file you’re working on in real time and get back the exact issues plus fix guidance — before the code is ever committed, as long as the repository is imported in Norma. See Live Check.
• It closes the loop. When your assistant verifies, fixes, or prevents an issue, it records that back to Norma, so the work shows up in your governance record and feeds your repository’s Production Ready Score.

The connection is read-and-report only: your editor can read rules and check files and record what it did — it can’t run full scans, import or delete repositories, or change your settings, members, or billing.

Set it up #

The full setup guide — the server URL, per-editor configuration, the browser sign-in, and the complete tool reference — lives in the Norma MCP server repository and is kept up to date there:

→ github.com/qualityclouds/norma-mcp

That repository is the source of truth for connecting an editor. In short:

• Connecting is signing in. The first time your editor uses the server, it opens a browser window to sign in — there are no API keys to paste. If you don’t have an account yet, one is created for you on the Free tier.
• Any MCP client works. The repo has ready-to-paste configuration for Cursor and Claude Code, and the same server URL works with VS Code, Lovable, Replit, and any other MCP-compatible editor.
• Five tools power the workflow: returning the rulesets for your stack, returning the rules in a ruleset, running a Live Check, listing the open issues from your last full scan, and recording what your assistant verified, fixed, or prevented.

Prefer a guided, VS Code-native experience? See Set up the VS Code extension.

Which repository a check is about #

Every call your editor makes carries the repository it concerns, as its git remote — the same URL git remote get-url origin returns. Norma matches that remote against the repositories your organisation has imported, and answers for the one it matched. Your agent reads the remote once and sends it with each call; there’s nothing to set up and nothing to link first.

Checks and records need an imported repository. Running a Live Check, listing open issues and recording applied actions all require a remote that matches a repository your organisation imported. Reading rules does not — your editor can fetch rulesets and rules before you’ve imported anything, which is what makes Norma useful from the first minute.

If the remote doesn’t match anything, Norma refuses the call and says why. When your organisation has a repository with the same name under a different owner or host, the refusal lists up to five candidates so your agent can show them to you and ask which one this workspace is. Your agent should never pick one for you — once you confirm, it retries with the URL you chose.

If nothing matches at all, the answer is to import the repository in Norma. The shared demo repository never matches, so it can’t be used as a stand-in.

Changed in 2.9.0. The link_repository tool is gone, and so is the idea of linking a repository to a connection once. One connection often serves several projects, so a single stored link meant answers could belong to the wrong project. Carrying the remote on every call removes that possibility. If an old CLAUDE.md, cached skill or blog post still tells your agent to call link_repository, it gets one unknown-tool error and carries on with the current tools — but it’s worth removing the instruction.

Where your results show up #

Everything your editor checks and records rolls up into your Norma workspace: the findings, the fixes and preventions, and your repository’s Production Ready Score. Open your workspace in the portal to see them alongside your full scans — the editor is a live front door to the same governance engine, not a separate system.

Limits & notes #

• Connecting an editor is available on every tier — Free and Pro — with no gating.
• Live checks run only on repositories you’ve imported. The repository quota of your tier is therefore also the boundary for checks — there’s no separate licence for them. See Tiers and quotas.
• Connection quota. Open MCP connections share a pool with your imported repositories: the Free tier allows 3, Pro and Team allow 20. If you reach the limit, free one up or upgrade before adding another. See Tiers and quotas.
• Live Check has its own rate limits, separate from your weekly scan quota — a Live Check never uses a scan. See Live Check → Limits.
• Setup no longer lives in a separate MCP Connections page. Connecting is the same action as signing in from your editor; there’s nothing to configure in the portal first.

Frequently asked questions #

Where do I get the server URL and config? From the Norma MCP server repository — it has the URL and copy-paste setup for each editor.

Do I need an API key? No — connecting is signing in through your browser. (API-key authentication exists for CI or headless environments that can’t open a browser; the repo covers it.)

Does connecting my editor let it change my account? No. It’s read-and-report only: read rules, check files, record the fixes it made. It can’t run scans, import or delete repositories, or touch settings and billing.

Where do I see what my editor found? In your Norma workspace, next to your full-scan results and Production Ready Score — and, on Pro and Team, on the Analytics screen, which shows what your team checked in the editor and what reached your branches.

My Live Check was refused — why? Almost always because the repository isn’t imported in Norma. The refusal names the reason, and lists same-named repositories in your organisation when there are any. Import the repository and retry.

Related #

• Norma MCP server on GitHub — the canonical setup and tool reference.
• Live Check — checking a single file in real time from your editor.
• Analytics — what your team checked in the editor, and what reached your branches.
• Set up the VS Code extension — the VS Code-native install path.
• Glossary → MCP — the protocol definition.
• Tiers and quotas — connection and scan quotas per tier.