MCP Server

What you’ll get: your IDE can ask ewake who owns a service, what it depends on, and what ewake already found the last time that service broke, without you leaving the editor or opening Slack.

Ewake exposes a remote MCP server (Model Context Protocol) at /mcp on your ewake instance.

This page is about querying ewake from an MCP client. To connect an MCP server of your own to ewake, so it can call your tools during investigations, see Custom MCP Server.

Prerequisites

An ewake instance reachable from your machine (e.g. https://your-company.ewake.ai)
An MCP client that supports remote servers over HTTP, Claude Code and Cursor both do
An ewake account, for the browser sign-in during the connection

Running ewake in your own AWS account? The MCP server is on the same hostname as your dashboard, but reaching it may depend on your network — see Self-hosted deployments below.

Connect your client

The connection uses OAuth: your client registers itself, sends you to your ewake dashboard to approve, and receives its own token. You never copy or paste a key.

Using a coding agent? The setup skills for coding agents add this server and start the sign-in for you.

Claude Code
Cursor
Other clients

claude mcp add --transport http ewake https://your-company.ewake.ai/mcp

Then run /mcp inside Claude Code and pick ewake to start the sign-in.

Add this to ~/.cursor/mcp.json:

~/.cursor/mcp.json

{
  "mcpServers": {
    "ewake": {
      "url": "https://your-company.ewake.ai/mcp"
    }
  }
}

Cursor picks up the change on save and shows a Needs login button next to the server.

Point the client at https://your-company.ewake.ai/mcp over streamable HTTP.The server publishes standard discovery documents, so a compliant client finds everything else on its own:

Document	Path
Protected resource metadata (RFC 9728)	`/.well-known/oauth-protected-resource`
Authorization server metadata (RFC 8414)	`/.well-known/oauth-authorization-server`
Dynamic client registration (RFC 7591)	`/oauth/register`
Token endpoint	`/oauth/token`

Approve the connection

Your browser opens on the ewake approval page

The client sends you to the authorization endpoint on your ewake instance. If you’re not signed in, you go through the normal dashboard login first and come back to the same page.

Review what the client is asking for

The page names the client, what it will be able to do (read your service map, ownership, incident history, deployments and integrations), and the address it will send you back to. Check that address is your client, then click Approve.

You land back in your client

The server shows as connected and its seven tools are listed. Ask it something, for example: “Who owns the checkout service?”

Alternative: connect with an API key

Use an API key when nobody can click Approve, a CI job, a script, or a container. It authenticates as your company rather than as a person.

Create the key

In your ewake dashboard, open API Keys in the sidebar and create a key. Copy it, it’s shown once and starts with ew_.

Send it as a bearer token

{
  "mcpServers": {
    "ewake": {
      "url": "https://your-company.ewake.ai/mcp",
      "headers": {
        "Authorization": "Bearer ew_YOUR_API_KEY"
      }
    }
  }
}

An API key is a shared credential, treat it like a password. It is also workspace-wide, not scoped to MCP: the same key can post deployment events. Prefer OAuth for anything a human uses, so calls are attributable to a person and revoking access doesn’t affect anyone else.

	OAuth	API key
Setup	Browser approval, nothing to copy	Create in the dashboard, paste into config
Identifies	The individual user	The company
Scope	The MCP tools, as that user	The whole workspace, MCP and the REST API alike
Lifetime	Access token 12 hours, refreshed automatically by the client for up to 30 days before you re-approve	Until you revoke it
Revoke	Deactivate the user, their token stops validating on the next call	Instantly, from API Keys
Best for	Your editor	CI, scripts, headless tools

Self-hosted deployments

The MCP server is not on a separate host. It is served by the same instance as your dashboard, on the same hostname:

https://<your ewake hostname>/mcp

If your dashboard is https://ewake.yourcompany.com, the MCP URL is https://ewake.yourcompany.com/mcp. That holds whether your load balancer is public or private — what changes is who can reach it.

If your load balancer is public

Nothing special. Follow either method above. Access is still bounded by alb_ingress_cidrs, so the machine running your MCP client has to be in a range you allow.

If your load balancer is private

With alb_internal = true, your hostname resolves to private addresses. An MCP client can connect only from a machine that is:

On your network — inside the VPC, over the VPN, or across the transit gateway, so the hostname resolves and routes, and
Inside alb_ingress_cidrs — the security group is what refuses the packet, and it refuses before anything is logged on the ewake side.

A laptop that resolves the name but sits outside those ranges will hang rather than fail cleanly. That is the security group dropping the connection, not ewake.

Use an API key, not OAuth, on a private deployment. The OAuth flow sends your browser to the dashboard to approve, then redirects back to the client. Behind a VPN that round trip often cannot complete, and the client waits on a callback that never arrives.An unauthenticated request to /mcp returns 401 advertising the OAuth discovery document, so a client that has no token will try OAuth first. That is expected, not a misconfiguration. Configure the bearer key up front and the client never starts the flow.

The inbound webhook gateway does not serve MCP

A private deployment can run a public API Gateway so Slack and Datadog can still deliver events. /mcp is deliberately not on it. That gateway carries a short allowlist of webhook paths and nothing else — pointing an MCP client at its execute-api.<region>.amazonaws.com URL returns 404. This is a deliberate boundary. Those webhook routes accept a fixed payload from a known sender; the MCP tools read your service map, your investigation history and your knowledge graph. Putting that behind the public gateway would undo the reason for choosing a private load balancer. If you want MCP reachable from outside your network, widen alb_ingress_cidrs to the range it should come from, which is a per-deployment decision you control.

Checking it works

From a machine on your network:

curl -sS -o /dev/null -w '%{http_code}\n' \
  -H "Authorization: Bearer ew_YOUR_API_KEY" \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"curl","version":"1.0"}}}' \
  https://<your ewake hostname>/mcp

200 means the whole path works: network, security group, TLS and the key. A hang points at routing or alb_ingress_cidrs; a 401 means the key is wrong or revoked.

Tools

The server has seven tools. Each one only reads.

Tool	What it does
`ewake_load_cypher_skill`	Loads the guide to your knowledge graph: node labels, relationship directions, and query examples. Your client calls it before its first graph query.
`ewake_list_service_names`	Lists the service names in your knowledge graph, with an optional search filter.
`ewake_run_cypher_query`	Runs a read-only Cypher query on your services, repositories and contributors. Results are capped at 50 rows.
`ewake_list_investigations`	Lists past investigations, most recent first. Filters on the question, the status, the task type, the channel, or a time window.
`ewake_get_investigation`	Returns one investigation: its written answer, the agent’s plan, and the findings behind it.
`ewake_list_deployments`	Lists the deployments ewake received in a time window, newest first. Filters on the repository or the artifact name.
`ewake_list_integrations`	Lists your integrations and the state of their discovery runs.

What to ask

The tools compose, so you ask the question and the client chains the calls:

Who owns the checkout service, and what does it depend on?

This PR touches payments-api. Has ewake investigated anything on it recently?

Show me what ewake found during the last checkout incident.

Which repositories feed into the services that depend on auth-service?

Security

Read-only. Every tool is a query. Nothing on the MCP server creates, edits or deletes anything in ewake or in your integrations.
Scoped to your company. Both authentication paths verify that the caller belongs to this instance’s company before the request reaches a tool.
Your credential never reaches the tools. The transport passes an identifier, not the API key or the access token.
Deactivated users lose access immediately, their token stops validating on the next call.

How ewake handles permissions and data →

Something you want to reach from your editor that isn’t here? Tell us at support@ewake.ai, the tool surface grows from what people ask for.

Introduction

Get Started

Integrations

Working With Ewake

Interfaces

Trust & Security

Resources

FAQ

Prerequisites

Connect your client

Approve the connection

Alternative: connect with an API key

Self-hosted deployments

If your load balancer is public

If your load balancer is private

The inbound webhook gateway does not serve MCP

Checking it works

Tools

What to ask

Security

How ewake handles permissions and data →

​Prerequisites

​Connect your client

​Approve the connection

​Alternative: connect with an API key

​Self-hosted deployments

​If your load balancer is public

​If your load balancer is private

​The inbound webhook gateway does not serve MCP

​Checking it works

​Tools

​What to ask

​Security

How ewake handles permissions and data →

Prerequisites

Connect your client

Approve the connection

Alternative: connect with an API key

Self-hosted deployments

If your load balancer is public

If your load balancer is private

The inbound webhook gateway does not serve MCP

Checking it works

Tools

What to ask

Security