Skip to main content Skip to content

MCP server

Connect Cursor, Claude, VS Code, or any MCP client to ZopDay. Ask about services, deployments, environments and live cloud state in plain language.

12 min read

The ZopDay MCP server lets an AI assistant read your workspace directly. Ask Claude “which services failed their last three deploys?” and it queries your live projects, deployments and cluster state instead of guessing.

It speaks the Model Context Protocol over Streamable HTTP. The clients below are the ones we have verified end to end; any other MCP-capable client connects the same way, using the Other tab.

Before you start

  1. Enable MCP for the organisation

    Open Settings → Organisation, scroll to the MCP Server section, and switch the toggle on. The badge changes from Inactive to Active and the server URL appears. Only a user with the Organisation Update permission sees the toggle.

  2. Copy your server URL

    Your server URL is https://api.zop.dev/mcp-server — it’s the same for every organisation. Auth negotiates the org, so you don’t need to look it up in the app.

Choose how to sign in

You have two ways to authenticate. Pick one — every client below supports both.

Nothing to configure up front. Just point your client at https://api.zop.dev/mcp-server and let it prompt on the first tool call. A browser tab opens to ZopDay, you approve the connection once, and the client stores refreshable tokens itself.

Option 2 — Personal Access Token

  1. Open Developer Settings

    Click your profile avatar at the bottom-left of the sidebar, then Developer Settings.

  2. Create the token

    Under API Tokens, click Create Token, name it after the client that will use it (“Cursor” or “Claude Code”), choose an expiry, and confirm.

  3. Copy it once

    The token is shown only once. Copy it straight into your secret manager, never into a committed file. The blocks below call it MCP_PAT.

ZopDay Developer Settings on the API Tokens tab, listing personal access tokens with their name, token prefix, the organisation each is scoped to, expiry, creation date and last-used time, plus rotate and revoke actions and a Create Token button

Developer Settings → API Tokens; the tokens that authenticate the API and your AI assistants over MCP, each scoped to the organisations and write capabilities you pick.

A token carries your identity, not a narrower one. Every call resolves your live role at the moment it is made, so mint it as the person with the narrowest role that does the job.

Set up your client

Find your client below and follow the steps for it. Every card walks through both OAuth (the recommended one-click sign-in) and Personal Access Token (for CI, servers, and clients that can’t open a browser) — pick whichever tab matches how you want to authenticate.

Client

Configure your MCP client to connect to your workspace.

Install in one click:

Add to Cursor

Or set it up manually:

  1. Open the MCP servers panel

    In Cursor, open Customize → MCPs → New MCP server. Cursor opens ~/.cursor/mcp.json for editing.

  2. Paste the config

    Pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the config.

    OAuth (recommended)
    {
    "mcpServers": {
    "zopdev": {
    "url": "https://api.zop.dev/mcp-server",
    "transport": "streamable-http"
    }
    }
    }
    Personal Access Token
    {
    "mcpServers": {
    "zopdev": {
    "url": "https://api.zop.dev/mcp-server",
    "transport": "streamable-http",
    "headers": { "Authorization": "Bearer MCP_PAT" }
    }
    }
    }

    For PAT, swap MCP_PAT for the token you copied at Developer Settings → API Tokens.

  3. Save and enable

    Save the file. Back on the MCPs panel, click the newly-added zopdev entry and turn the User (~/.cursor/mcp.json) toggle on.

  4. Reload and authenticate

    Click Reload on the zopdev entry. OAuth opens a browser window to sign in — approve to finish. PAT users skip this: the token authenticates every call. The tools appear inside Cursor on the next call.

  1. Add the server

    Inside a Claude Code session, pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the command. The -t http flag is required, otherwise Claude records the URL as a program to execute.

    OAuth (recommended)
    claude mcp add zopdev https://api.zop.dev/mcp-server -t http
    Personal Access Token
    claude mcp add zopdev https://api.zop.dev/mcp-server -t http -H "Authorization: Bearer MCP_PAT"

    For PAT, swap MCP_PAT for the token you copied at Developer Settings → API Tokens.

  2. Restart Claude

    Quit Claude Code and start a fresh session with claude. The new MCP server is picked up on startup.

  3. Authenticate

    In the session, run /mcp, find the zopdev entry, and select Authenticate. OAuth opens a browser window to sign in — approve to finish. PAT users skip this: the header authenticates every call.

  1. Open the custom connector form

    In Claude Desktop, click your profile → Settings → Connectors → Add → Add custom connector.

  2. Fill in the details

    • Name: zopdev
    • Remote MCP Server URL: https://api.zop.dev/mcp-server

    Then click Continue.

  3. Add and connect

    Claude Desktop shows a few security-verification prompts — accept each one, then click Add to save the connector. Finally click Connect: OAuth opens a browser window to sign in — approve to finish.

Install in one click:

Add to VS Code

Or set it up manually:

  1. Open the MCP config file

    In VS Code (1.99+), open the Command Palette (Cmd + Shift + P on macOS, Ctrl + Shift + P on Windows/Linux), type MCP, and pick the command that opens your user MCP config file (labelled something like MCP: Open User Configuration). To scope the server to one project instead, create .vscode/mcp.json in the workspace root.

  2. Paste the config

    Pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the config.

    OAuth (recommended)
    {
    "servers": {
    "zopdev": {
    "url": "https://api.zop.dev/mcp-server",
    "type": "http"
    }
    }
    }
    Personal Access Token
    {
    "servers": {
    "zopdev": {
    "url": "https://api.zop.dev/mcp-server",
    "type": "http",
    "headers": { "Authorization": "Bearer MCP_PAT" }
    }
    }
    }

    For PAT, swap MCP_PAT for the token you copied at Developer Settings → API Tokens.

  3. Save and authenticate

    Save the file. VS Code starts the server automatically and shows a ✓ Running · Stop · Restart · More… inlay hint above the zopdev entry. On the first tool call, OAuth opens a browser window to sign in — approve to finish. PAT users skip this: the header authenticates every call.

    You can also manage the server from Extensions → MCP Servers - Installed → zopdev.

  1. Add the server

    Inside a Codex CLI session, pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the command.

    OAuth (recommended)
    codex mcp add zopdev --url https://api.zop.dev/mcp-server
    Personal Access Token
    export ZOPDEV_MCP_PAT=<your token>
    codex mcp add zopdev --url https://api.zop.dev/mcp-server --bearer-token-env-var ZOPDEV_MCP_PAT

    Grab <your token> from Developer Settings → API Tokens and export it in the shell before Codex launches — Codex reads the env var by name at connect time.

  2. Authenticate

    Run codex mcp login zopdev and follow the prompts — OAuth opens a browser window to sign in, approve to finish. PAT users skip this: the bearer env var authenticates every call.

  1. Open your client's MCP config

    Any client that speaks the standard MCP JSON config works. Find its config file or MCP settings UI in its docs.

  2. Check the field names

    Some clients use serverUrl instead of url, or type instead of transport. The URL and header values below stay the same — only the surrounding key names change.

  3. Paste one of these configs

    Pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the config.

    OAuth (recommended)
    {
    "mcpServers": {
    "zopday": {
    "url": "https://api.zop.dev/mcp-server",
    "transport": "streamable-http"
    }
    }
    }
    Personal Access Token
    {
    "mcpServers": {
    "zopday": {
    "url": "https://api.zop.dev/mcp-server",
    "transport": "streamable-http",
    "headers": { "Authorization": "Bearer MCP_PAT" }
    }
    }
    }

    For PAT, swap MCP_PAT for the token you copied at Developer Settings → API Tokens.

  4. Save and connect

    Save the config and restart the client. On the first tool call, OAuth opens a browser to sign in — approve to finish. PAT users skip this: the header authenticates every call.

Confirm it works

Start a fresh session and ask:

Terminal window
List my organisations

A working connection calls list_organisations and reads back your organisations by name. Run this before asking anyone for help: it isolates the connection from everything else, because list_organisations is the only tool that needs no arguments, and every other tool takes the org_id it returns.

If it fails, the usual causes are the transport flag, an expired token, the organisation toggle still being off, or (for OAuth) refusing the browser prompt.

What the tools cover

The MCP catalogue is 289 tools (165 read + 124 write), grouped by area below with a few examples of each:

AreaCoversFor example
Organisations & permissionsThe organisations you can reach, their settings, and what your own token may dolist_organisations, get_my_permissions, check_eligibility
Resources & discoveryResources across AWS, GCP and Azure, one-call resource overviews, valid filter values, blast radius, cloud accountsget_resource_overview, list_resources, get_resource_filters, get_blast_radius
Cost & billingSpend by provider, resource, team and tag, trends over time, anomalies, billing sync health, AI Gateway spendget_cost_overview, get_cost_trends, get_anomalies, get_cost_by_team
BudgetsBudgets with spend and status, health summaries, and creating or changing an alerting thresholdlist_budgets, get_budget_spend, create_budget
RecommendationsOptimisation findings with savings and severity, and the remediation inboxget_recommendations, get_recommendation_summary, list_workflows
Schedules, groups & overridesStart/stop schedules and their windows, resource groups, and temporary overrideslist_schedules, get_override_candidates, create_schedule, create_override
Actions & historyScheduler events, state transitions, action outcomes, and starting or stopping a resourceget_state_history, list_events, start_resource, stop_resource
Teams, users & rolesTeams and their members and resources, users, and role definitionslist_teams, list_team_resources, list_roles
Tagging & smart tagsTagging policies, the tags ZopDay derives, and accepting them into cost attributionlist_tagging_policies, list_smart_tags, accept_smart_tag
Audit & notificationsAudit entries, and the Slack, Teams, Chat and webhook channels configuredlist_audit_logs, list_notification_channels

For the authoritative list, call tools/list or ask your assistant what tools it has. It is filtered to what your token and role allow, so it is the answer for you rather than the whole catalogue.

Two tools are worth leading with: get_cost_overview answers “where is the money going” in one call, and get_resource_overview answers everything about one resource, including its metrics, cost history and recommendations. Both replace a handful of narrower calls.

Reads and writes

Most tools read. A smaller set writes: it changes a schedule, sets a budget, accepts a tag, starts or stops a resource.

How much an agent may change is one setting per organisation, Write access, in Settings → Organisation. The levels are cumulative, so choosing one admits everything below it:

Write accessAdmitsFor example
Read-onlyNothing. Read tools only.
Metadata onlyZopDay’s own records. No cloud state, no cost.Budgets, recommendation status, smart-tag acceptance
Reversible changesBounded blast radius, may affect cost.Schedules, overrides, tagging policies
Irreversible changesNo undo, or incurs cost.Starting and stopping resources

Some capabilities are excluded at every level, and no setting adds them: roles and permissions, user management, organisation deletion, cloud-account deletion, credentials, and bulk actions. Each has read-only coverage at most.

An agent can never exceed the permissions of the person whose token it holds. Your role is resolved on every call, so revoking someone’s access in the app takes effect on their next tool call, and every write is recorded in the audit trail.

Where to next

Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·