MCP server
Connect Cursor, Claude, VS Code, or any MCP client to ZopDay. Ask about services, deployments, environments and live cloud state in plain language.
The ZopDay MCP server lets an AI assistant read your workspace directly. Ask Claude “which services failed their last three deploys?” and it queries your live projects, deployments and cluster state instead of guessing.
It speaks the Model Context Protocol over Streamable HTTP. The clients below are the ones we have verified end to end; any other MCP-capable client connects the same way, using the Other tab.
Before you start
Enable MCP for the organisation
Open Settings → Organisation, scroll to the MCP Server section, and switch the toggle on. The badge changes from Inactive to Active and the server URL appears. Only a user with the Organisation Update permission sees the toggle.
Copy your server URL
Your server URL is
https://api.zop.dev/mcp-server— it’s the same for every organisation. Auth negotiates the org, so you don’t need to look it up in the app.
Choose how to sign in
You have two ways to authenticate. Pick one — every client below supports both.
OAuth
Recommended. No token to copy, no secret to store. Sign in once in a browser window, then your client is connected. Sessions appear on Developer Settings → Connected Apps and can be revoked any time.
Personal Access Token
For CI, servers, or clients that can’t open a browser. You mint a long-lived token in Developer Settings and pass it as an Authorization: Bearer header.
Option 1 — OAuth (recommended)
Nothing to configure up front. Just point your client at https://api.zop.dev/mcp-server and let it prompt on the first tool call. A browser tab opens to ZopDay, you approve the connection once, and the client stores refreshable tokens itself.
Option 2 — Personal Access Token
Open Developer Settings
Click your profile avatar at the bottom-left of the sidebar, then Developer Settings.
Create the token
Under API Tokens, click Create Token, name it after the client that will use it (“Cursor” or “Claude Code”), choose an expiry, and confirm.
Copy it once
The token is shown only once. Copy it straight into your secret manager, never into a committed file. The blocks below call it
MCP_PAT.

Developer Settings → API Tokens; the tokens that authenticate the API and your AI assistants over MCP, each scoped to the organisations and write capabilities you pick.
A token carries your identity, not a narrower one. Every call resolves your live role at the moment it is made, so mint it as the person with the narrowest role that does the job.
Set up your client
Find your client below and follow the steps for it. Every card walks through both OAuth (the recommended one-click sign-in) and Personal Access Token (for CI, servers, and clients that can’t open a browser) — pick whichever tab matches how you want to authenticate.
Configure your MCP client to connect to your workspace.
Install in one click:
Add to CursorOr set it up manually:
Open the MCP servers panel
In Cursor, open Customize → MCPs → New MCP server. Cursor opens
~/.cursor/mcp.jsonfor editing.Paste the config
Pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the config.
OAuth (recommended) {"mcpServers": {"zopdev": {"url": "https://api.zop.dev/mcp-server","transport": "streamable-http"}}}Personal Access Token {"mcpServers": {"zopdev": {"url": "https://api.zop.dev/mcp-server","transport": "streamable-http","headers": { "Authorization": "Bearer MCP_PAT" }}}}For PAT, swap
MCP_PATfor the token you copied at Developer Settings → API Tokens.Save and enable
Save the file. Back on the MCPs panel, click the newly-added zopdev entry and turn the User (
~/.cursor/mcp.json) toggle on.Reload and authenticate
Click Reload on the zopdev entry. OAuth opens a browser window to sign in — approve to finish. PAT users skip this: the token authenticates every call. The tools appear inside Cursor on the next call.
Add the server
Inside a Claude Code session, pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the command. The
-t httpflag is required, otherwise Claude records the URL as a program to execute.OAuth (recommended) claude mcp add zopdev https://api.zop.dev/mcp-server -t httpPersonal Access Token claude mcp add zopdev https://api.zop.dev/mcp-server -t http -H "Authorization: Bearer MCP_PAT"For PAT, swap
MCP_PATfor the token you copied at Developer Settings → API Tokens.Restart Claude
Quit Claude Code and start a fresh session with
claude. The new MCP server is picked up on startup.Authenticate
In the session, run
/mcp, find the zopdev entry, and select Authenticate. OAuth opens a browser window to sign in — approve to finish. PAT users skip this: the header authenticates every call.
Open the custom connector form
In Claude Desktop, click your profile → Settings → Connectors → Add → Add custom connector.
Fill in the details
- Name:
zopdev - Remote MCP Server URL:
https://api.zop.dev/mcp-server
Then click Continue.
- Name:
Add and connect
Claude Desktop shows a few security-verification prompts — accept each one, then click Add to save the connector. Finally click Connect: OAuth opens a browser window to sign in — approve to finish.
Install in one click:
Add to VS CodeOr set it up manually:
Open the MCP config file
In VS Code (1.99+), open the Command Palette (
Cmd + Shift + Pon macOS,Ctrl + Shift + Pon Windows/Linux), typeMCP, and pick the command that opens your user MCP config file (labelled something like MCP: Open User Configuration). To scope the server to one project instead, create.vscode/mcp.jsonin the workspace root.Paste the config
Pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the config.
OAuth (recommended) {"servers": {"zopdev": {"url": "https://api.zop.dev/mcp-server","type": "http"}}}Personal Access Token {"servers": {"zopdev": {"url": "https://api.zop.dev/mcp-server","type": "http","headers": { "Authorization": "Bearer MCP_PAT" }}}}For PAT, swap
MCP_PATfor the token you copied at Developer Settings → API Tokens.Save and authenticate
Save the file. VS Code starts the server automatically and shows a ✓ Running · Stop · Restart · More… inlay hint above the
zopdeventry. On the first tool call, OAuth opens a browser window to sign in — approve to finish. PAT users skip this: the header authenticates every call.You can also manage the server from Extensions → MCP Servers - Installed → zopdev.
Add the server
Inside a Codex CLI session, pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the command.
OAuth (recommended) codex mcp add zopdev --url https://api.zop.dev/mcp-serverPersonal Access Token export ZOPDEV_MCP_PAT=<your token>codex mcp add zopdev --url https://api.zop.dev/mcp-server --bearer-token-env-var ZOPDEV_MCP_PATGrab
<your token>from Developer Settings → API Tokens and export it in the shell before Codex launches — Codex reads the env var by name at connect time.Authenticate
Run
codex mcp login zopdevand follow the prompts — OAuth opens a browser window to sign in, approve to finish. PAT users skip this: the bearer env var authenticates every call.
Open your client's MCP config
Any client that speaks the standard MCP JSON config works. Find its config file or MCP settings UI in its docs.
Check the field names
Some clients use
serverUrlinstead ofurl, ortypeinstead oftransport. The URL and header values below stay the same — only the surrounding key names change.Paste one of these configs
Pick OAuth (recommended) or a Personal Access Token — the tabs below toggle the config.
OAuth (recommended) {"mcpServers": {"zopday": {"url": "https://api.zop.dev/mcp-server","transport": "streamable-http"}}}Personal Access Token {"mcpServers": {"zopday": {"url": "https://api.zop.dev/mcp-server","transport": "streamable-http","headers": { "Authorization": "Bearer MCP_PAT" }}}}For PAT, swap
MCP_PATfor the token you copied at Developer Settings → API Tokens.Save and connect
Save the config and restart the client. On the first tool call, OAuth opens a browser to sign in — approve to finish. PAT users skip this: the header authenticates every call.
Confirm it works
Start a fresh session and ask:
List my organisationsA working connection calls list_organisations and reads back your organisations by name. Run this before asking anyone for help: it isolates the connection from everything else, because list_organisations is the only tool that needs no arguments, and every other tool takes the org_id it returns.
If it fails, the usual causes are the transport flag, an expired token, the organisation toggle still being off, or (for OAuth) refusing the browser prompt.
What the tools cover
The MCP catalogue is 289 tools (165 read + 124 write), grouped by area below with a few examples of each:
| Area | Covers | For example |
|---|---|---|
| Organisations & permissions | The organisations you can reach, their settings, and what your own token may do | list_organisations, get_my_permissions, check_eligibility |
| Resources & discovery | Resources across AWS, GCP and Azure, one-call resource overviews, valid filter values, blast radius, cloud accounts | get_resource_overview, list_resources, get_resource_filters, get_blast_radius |
| Cost & billing | Spend by provider, resource, team and tag, trends over time, anomalies, billing sync health, AI Gateway spend | get_cost_overview, get_cost_trends, get_anomalies, get_cost_by_team |
| Budgets | Budgets with spend and status, health summaries, and creating or changing an alerting threshold | list_budgets, get_budget_spend, create_budget |
| Recommendations | Optimisation findings with savings and severity, and the remediation inbox | get_recommendations, get_recommendation_summary, list_workflows |
| Schedules, groups & overrides | Start/stop schedules and their windows, resource groups, and temporary overrides | list_schedules, get_override_candidates, create_schedule, create_override |
| Actions & history | Scheduler events, state transitions, action outcomes, and starting or stopping a resource | get_state_history, list_events, start_resource, stop_resource |
| Teams, users & roles | Teams and their members and resources, users, and role definitions | list_teams, list_team_resources, list_roles |
| Tagging & smart tags | Tagging policies, the tags ZopDay derives, and accepting them into cost attribution | list_tagging_policies, list_smart_tags, accept_smart_tag |
| Audit & notifications | Audit entries, and the Slack, Teams, Chat and webhook channels configured | list_audit_logs, list_notification_channels |
For the authoritative list, call tools/list or ask your assistant what tools it has. It is filtered to what your token and role allow, so it is the answer for you rather than the whole catalogue.
Two tools are worth leading with: get_cost_overview answers “where is the money going” in one call, and get_resource_overview answers everything about one resource, including its metrics, cost history and recommendations. Both replace a handful of narrower calls.
Reads and writes
Most tools read. A smaller set writes: it changes a schedule, sets a budget, accepts a tag, starts or stops a resource.
How much an agent may change is one setting per organisation, Write access, in Settings → Organisation. The levels are cumulative, so choosing one admits everything below it:
| Write access | Admits | For example |
|---|---|---|
| Read-only | Nothing. Read tools only. | — |
| Metadata only | ZopDay’s own records. No cloud state, no cost. | Budgets, recommendation status, smart-tag acceptance |
| Reversible changes | Bounded blast radius, may affect cost. | Schedules, overrides, tagging policies |
| Irreversible changes | No undo, or incurs cost. | Starting and stopping resources |
Some capabilities are excluded at every level, and no setting adds them: roles and permissions, user management, organisation deletion, cloud-account deletion, credentials, and bulk actions. Each has read-only coverage at most.
An agent can never exceed the permissions of the person whose token it holds. Your role is resolved on every call, so revoking someone’s access in the app takes effect on their next tool call, and every write is recorded in the audit trail.
Where to next
- Authentication — token expiry, rotation, and the other ways in.