MCP setup

The MCP HTTP server lives in apps/mcp and delegates tool registration to @loftlancer/mcp (registerMcpTools). Each tool maps to a canonical action implemented in **@loftlancer/api/mcp.

End users: start with Using MCP and Connect MCP clients.

EndpointsCopy Anchor Link

Configure your client with:

• Auth issuer — NEXT_PUBLIC_AUTH_URL (default https://loftlancer.com/auth)
• MCP URL — NEXT_PUBLIC_MCP_URL (deployment-specific)

Tokens must include the base scope mcp:tools plus resource scopes listed on each tool page. The auth app advertises scopes from MCP_OAUTH_SCOPES in @loftlancer/actions.

Tool discoveryCopy Anchor Link

Call the built-in permissions_snapshot tool (requires only mcp:tools) to list exposed actions, tool names, required scopes, and descriptions — same data as the tool index.

Rate limitsCopy Anchor Link

@loftlancer/mcp applies per-user and per-client rate limits (rate-limit.ts). Write and reveal verbs use stricter limits than reads.

AuthorizationCopy Anchor Link

Scopes gate whether a tool may be invoked; requireAction still enforces org role and project grants on the server. A token with projects:write cannot bypass missing org membership.

RelatedCopy Anchor Link

• OAuth scopes
• Tool reference
• Better Auth MCP plugin