Connect Claude Code to ZopNight over MCP

ZopNight runs a Model Context Protocol server, so an AI assistant can query your cost and resource data directly. Supported clients include Claude Code, Cursor, Codex and Claude Desktop, and the in-app setup guide also walks through Devin, Antigravity and Grok build. This guide connects Claude Code, which takes one command once you have a token.

Before you start

• Claude Code installed.
• An organisation admin available for one setting, unless you are one.
• Network access from your machine to your ZopNight gateway.

1. Enable MCP for the organisation

MCP access has an organisation-level switch. Ask an admin to turn it on for your organisation, and get the MCP server URL for your deployment at the same time. While the switch is off, no client can use the server, whatever the token.

2. Create a personal access token

Personal access tokens live in Developer Settings. Create one, name it for its use (“Claude Code, laptop”), pick an expiry, and copy it. ZopNight tokens start with zn_pat_. Store it in a secret manager, not in a file that could be committed.

The token acts as you. Every call is checked against your live role at the moment it is made, so if your role narrows, so does what Claude can do, and it can never exceed your own access.

3. Add the server to Claude Code

Claude Code adds remote servers with claude mcp add and the HTTP transport; a bearer token goes in a header:

claude mcp add --transport http zopnight https://YOUR-ZOPNIGHT-MCP-URL \
  --header "Authorization: Bearer zn_pat_YOUR_TOKEN"

Use the exact URL for your deployment. Without --scope, the server is added to your local scope; add --scope user to make it available in every project, or --scope project to share it through .mcp.json (never commit a token that way).

4. Confirm the connection

claude mcp list

The ZopNight entry should show as connected. claude mcp get zopnight shows its details, and inside a session /mcp shows server status. If the add succeeded but the connection fails, check in order: the URL, an expired or mistyped token, and the organisation switch from step 1.

Then, in a Claude Code session, ask a simple question such as “list my ZopNight organisations”, followed by “what are my ZopNight permissions?”. The second tells you exactly what the token resolves to.

What Claude can and cannot do

The tool list Claude sees is filtered at the gateway to what your token, your role and your organisation’s settings allow, so anything advertised is callable. Reads cover resources, schedules, costs, recommendations, teams, budgets, audit logs, cloud accounts, overrides, notifications, billing sync, dashboards, autoscaler, event readiness and governance policy. List tools forward provider, status, region, search and sort filters, so questions stay precise.

Changes are a separate, per-organisation decision. The write tier starts at none, and the levels above it are metadata-only, reversible and irreversible; the irreversible tier also requires an organisation-bound token. MCP writes also sit behind a platform-wide switch that is currently off, so in practice a connection today is read-only.

Role and member management sit at tier 1 and bulk start and stop at tier 3, so they arrive only when the organisation opts in that far. Some things are never available at any tier: organisation deletion, cloud-account deletion, credential reads, and org-level role assignment. Service configuration reads redact every environment variable value. Every MCP call, reads included, is written to the audit log with its source marked as MCP.

Revoking access

Delete the token in Developer Settings to cut that client off. An admin turning off the organisation switch cuts every client at once. In Claude Code, claude mcp remove zopnight deletes the local entry. More on the server and its tools: the ZopNight MCP server and MCP tools.