Connect Claude Code to your ZopNight account so you can ask about cloud cost, resources, schedules and recommendations in the terminal, and get answers from live data.
Budget about ten minutes. The whole setup is read-only: Claude can read your estate, and it cannot change anything. Every step is reversible, and deleting the token cuts access instantly.
Before you start, you need Claude Code installed, an admin on your ZopNight organisation (or admin rights yourself) for one toggle, and network access to the ZopNight gateway.
Step 1: Enable MCP for your organisation
MCP is off by default for every organisation. Only a user with the Organisation Update permission can turn it on, so if you are not an admin, this is the one step to ask for.
- Log in to ZopNight and open Settings from the sidebar
- Click the Organisation tab
- In the Organisation details card, scroll to the MCP Server section, below the created date
- Toggle the switch to ON
The status badge changes from Inactive to Active, and the server URL appears. If you cannot see the toggle at all, your role does not carry the permission.
Step 2: Create a Personal Access Token
This is where most setups stall, so here is the exact path.
- Click your profile avatar at the bottom-left of the sidebar
- Select Developer Settings
- Click Create Token
- Enter a name, for example “Claude Code”
- Choose an expiry period
- Click Create Token
Copy the token immediately. It starts with zn_pat_ and is shown exactly once. Put it in your secret manager, not in a file you might commit.
One thing worth understanding before you mint it: the token carries your identity, not a narrower one. It can do exactly what you can do in the ZopNight UI, no more and no less, and every call resolves your live role at the moment it is made. If your role changes or you leave the organisation, the token’s reach changes with it immediately. So mint it as the person with the narrowest role that does the job.
Step 3: Copy the server URL
On that same Developer Settings screen you will see MCP Server URL with a copy button. It also appears in Settings → Organisation once the toggle from Step 1 is on.
Copy it from there. The URL is specific to your deployment, so use the one the app shows you rather than one from a blog post.
Step 4: Add the server to Claude Code
Open your terminal and run:
claude mcp add zopnight MCP_SERVER_URL -t http -H "Authorization: Bearer MCP_PAT"Replace MCP_SERVER_URL with the URL from Step 3 and MCP_PAT with the token from Step 2.
The -t http flag is not optional. ZopNight’s MCP server uses Streamable HTTP: JSON-RPC 2.0 over HTTP POST, returning either a single JSON response or a Server-Sent Events stream when the client asks for one. It is not WebSocket based. Without the flag, Claude Code treats the URL as a command to run rather than a server to call. Type the URL and token literally, with no angle brackets: < and > are shell redirection operators and will break the command.
Step 5: Test with a query
Start a new Claude Code session and ask:
List my organisationsA working connection calls the list_organisations tool and returns your organisations by name.
Start with this one specifically. list_organisations is the only tool that takes no arguments, and every other tool needs the org_id it returns, so it separates “is the connection up” from “did I ask the question correctly.” If it works, everything after this is a question of permissions rather than plumbing.
If it fails, the causes in order of likelihood are: the missing -t http flag, a token that was mistyped or has expired, or the organisation toggle from Step 1 still being off.
Step 6: Confirm what Claude can see
Before you point it at anything real, ask:
What are my ZopNight permissions?That calls get_my_permissions and reports the access your token actually resolves to. You can also ask Claude which ZopNight tools it has: the list it reports is filtered to what your token, your role, and your organisation’s settings genuinely allow, so nothing it advertises will fail with a permission error, and nothing you could have called is hidden.
This is the step people skip and then get surprised by. Two minutes here tells you exactly what an assistant session can reach.
What you can ask once it is connected
The server exposes 85 read tools across your estate, so questions like these resolve against live data:
- “What are my top idle EC2 instances this week?”
- “Show me open recommendations over $500 a month on AWS”
- “Which resources are not covered by any schedule?”
- “What did our Azure spend do over the last 30 days, and why?”
List tools forward the full filter and pagination set (provider, status, region, search, sort), so Claude asks a precise question rather than pulling your whole estate and filtering afterwards.
What it cannot do
Most tools read. How much Claude may change is one setting per organisation, Write access in Settings → Organisation, with four cumulative levels: Read-only, Metadata only, Reversible changes, and Irreversible changes. At Read-only, Claude can observe your estate and cannot start, stop, or remediate anything.
Claude can never exceed the permissions of the person whose token it holds.
Some capabilities are excluded at every level and no setting adds them: roles and permissions, user management, organisation deletion, cloud-account deletion, credentials, and bulk actions. get_service_config returns environment variable keys with every value redacted, so no tool reveals an env var value for any role.
Every write is recorded in the same audit trail as the rest of the API, tagged with a source of mcp, so you can see what an assistant changed and when.
Other clients
The same server URL and Authorization header work everywhere. Cursor and Codex have their own setup panels inside ZopNight’s Developer Settings, and the MCP server guide covers every supported client side by side.
Claude Desktop connects remote MCP servers through its own Connectors interface rather than a config file. ZopNight documents and tests Claude Code, Cursor and Codex, so if you are setting this up for the first time, use Claude Code.
Full client-by-client instructions and the complete tool catalogue live in the MCP server documentation.
Questions we get a lot.
If yours isn't here, email us and we'll answer directly.
Do I need admin access to set this up?
Only for Step 1. Enabling the MCP toggle needs the Organisation Update permission, so a non-admin has to ask once. Creating your own token and connecting Claude Code needs no special role, and the token grants exactly the access your existing role already has.
Why does Claude Code need the -t http flag?
ZopNight's MCP server uses Streamable HTTP, which is JSON-RPC 2.0 over HTTP POST. It returns a single JSON response, or a Server-Sent Events stream when the client asks for one. It is not WebSocket based. Without the flag, Claude Code treats the URL as a command to run rather than a server to call.
Can Claude change anything in my cloud accounts?
Only as far as you allow. How much an agent may change is one per-organisation setting, Write access, in Settings then Organisation, with four cumulative levels: Read-only, Metadata only, Reversible changes, and Irreversible changes. An agent can never exceed the permissions of the person whose token it holds.
Does this work with Claude Desktop?
Claude Desktop connects remote MCP servers through its Connectors interface rather than the command above. ZopNight documents and tests Claude Code, Cursor and Codex, and each has a setup panel in Developer Settings, so use Claude Code for a first setup.
How do I revoke access?
Delete the token in Developer Settings and the connection stops working immediately. You can also switch the org-level MCP toggle off, which cuts every client at once. Access also narrows on its own if your role changes, since permissions resolve per request against your live role.