> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ewake.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP Server

> Connect ewake to Claude Code, Cursor, or any MCP client, and query your service map and past investigations from your editor.

<Info>
  **What you'll get:** your IDE can ask ewake who owns a service, what it depends on, and what ewake already found the last time that service broke, without you leaving the editor or opening Slack.
</Info>

Ewake exposes a **remote MCP server** (Model Context Protocol) at `/mcp` on your ewake instance.

<Note>
  This page is about querying ewake **from** an MCP client. To connect an MCP server of your own **to** ewake, so it can call your tools during investigations, see [Custom MCP Server](/integrations/custom/custom-mcp).
</Note>

***

## Prerequisites

* An ewake instance reachable from your machine (e.g. `https://your-company.ewake.ai`)
* An MCP client that supports remote servers over HTTP, Claude Code and Cursor both do
* An ewake account, for the browser sign-in during the connection

***

## Connect your client

The connection uses OAuth: your client registers itself, sends you to your ewake dashboard to approve, and receives its own token. **You never copy or paste a key.**

<Tabs>
  <Tab title="Claude Code">
    ```bash theme={null}
    claude mcp add --transport http ewake https://your-company.ewake.ai/mcp
    ```

    Then run `/mcp` inside Claude Code and pick **ewake** to start the sign-in.
  </Tab>

  <Tab title="Cursor">
    Add this to `~/.cursor/mcp.json`:

    ```json ~/.cursor/mcp.json theme={null}
    {
      "mcpServers": {
        "ewake": {
          "url": "https://your-company.ewake.ai/mcp"
        }
      }
    }
    ```

    Cursor picks up the change on save and shows a **Needs login** button next to the server.
  </Tab>

  <Tab title="Other clients">
    Point the client at `https://your-company.ewake.ai/mcp` over **streamable HTTP**.

    The server publishes standard discovery documents, so a compliant client finds everything else on its own:

    | Document                                 | Path                                      |
    | ---------------------------------------- | ----------------------------------------- |
    | Protected resource metadata (RFC 9728)   | `/.well-known/oauth-protected-resource`   |
    | Authorization server metadata (RFC 8414) | `/.well-known/oauth-authorization-server` |
    | Dynamic client registration (RFC 7591)   | `/oauth/register`                         |
    | Token endpoint                           | `/oauth/token`                            |
  </Tab>
</Tabs>

### Approve the connection

<Steps>
  <Step title="Your browser opens on the ewake approval page">
    The client sends you to the authorization endpoint on your ewake instance. If you're not signed in, you go through the normal dashboard login first and come back to the same page.
  </Step>

  <Step title="Review what the client is asking for">
    The page names the client, what it will be able to do (**read your service map, ownership and incident history**), and the address it will send you back to. Check that address is your client, then click **Approve**.
  </Step>

  <Step title="You land back in your client">
    <Check>
      The server shows as connected and its four tools are listed. Ask it something, for example: *"Who owns the checkout service?"*
    </Check>
  </Step>
</Steps>

***

## Alternative: connect with an API key

Use an API key when nobody can click **Approve**, a CI job, a script, or a container. It authenticates as your company rather than as a person.

<Steps>
  <Step title="Create the key">
    In your ewake dashboard, open **API Keys** in the sidebar and create a key. Copy it, it's shown once and starts with `ew_`.
  </Step>

  <Step title="Send it as a bearer token">
    ```json theme={null}
    {
      "mcpServers": {
        "ewake": {
          "url": "https://your-company.ewake.ai/mcp",
          "headers": {
            "Authorization": "Bearer ew_YOUR_API_KEY"
          }
        }
      }
    }
    ```
  </Step>
</Steps>

<Warning>
  An API key is a shared credential, treat it like a password. It is also **workspace-wide, not scoped to MCP**: the same key can post deployment events. Prefer OAuth for anything a human uses, so calls are attributable to a person and revoking access doesn't affect anyone else.
</Warning>

|            | OAuth                                                                                                | API key                                         |
| ---------- | ---------------------------------------------------------------------------------------------------- | ----------------------------------------------- |
| Setup      | Browser approval, nothing to copy                                                                    | Create in the dashboard, paste into config      |
| Identifies | The individual user                                                                                  | The company                                     |
| Scope      | The MCP tools, as that user                                                                          | The whole workspace, MCP and the REST API alike |
| Lifetime   | Access token 12 hours, refreshed automatically by the client for up to 30 days before you re-approve | Until you revoke it                             |
| Revoke     | Deactivate the user, their token stops validating on the next call                                   | Instantly, from **API Keys**                    |
| Best for   | Your editor                                                                                          | CI, scripts, headless tools                     |

***

## What to ask

The tools compose, so you ask the question and the client chains the calls:

```
Who owns the checkout service, and what does it depend on?
```

```
This PR touches payments-api. Has ewake investigated anything on it recently?
```

```
Show me what ewake found during the last checkout incident.
```

```
Which repositories feed into the services that depend on auth-service?
```

***

## Security

* **Read-only.** Every tool is a query. Nothing on the MCP server creates, edits or deletes anything in ewake or in your integrations.
* **Scoped to your company.** Both authentication paths verify that the caller belongs to this instance's company before the request reaches a tool.
* **Your credential never reaches the tools.** The transport passes an identifier, not the API key or the access token.
* **Deactivated users lose access immediately**, their token stops validating on the next call.

<Card title="How ewake handles permissions and data →" icon="shield" href="/security/permissions" horizontal />

***

<Note>
  Something you want to reach from your editor that isn't here? Tell us at [support@ewake.ai](/support), the tool surface grows from what people ask for.
</Note>