# How to Set Up ZopNight MCP for Claude: Step by Step > Connect Claude Code to ZopNight over MCP in about ten minutes. Enable the org toggle, mint a token, add the server, and confirm what Claude can and cannot see. Source: https://zop.dev/learn/how-to/set-up-zopnight-mcp-for-claude Published: 2026-07-01 · Updated: 2026-08-07 · Author: avinash-gaurav · Tags: zopnight, how-to, learn, mcp, claude --- Connect Claude Code to your ZopNight account so you can ask about cloud cost, resources, schedules and recommendations in the terminal, and get answers from live data. Budget about ten minutes. The whole setup is read-only: Claude can read your estate, and it cannot change anything. Every step is reversible, and deleting the token cuts access instantly. **Before you start**, you need Claude Code installed, an admin on your ZopNight organisation (or admin rights yourself) for one toggle, and network access to the ZopNight gateway. ## Step 1: Enable MCP for your organisation MCP is off by default for every organisation. Only a user with the Organisation Update permission can turn it on, so if you are not an admin, this is the one step to ask for. 1. Log in to ZopNight and open **Settings** from the sidebar 2. Click the **Organisation** tab 3. In the Organisation details card, scroll to the **MCP Server** section, below the created date 4. Toggle the switch to **ON** The status badge changes from Inactive to Active, and the server URL appears. If you cannot see the toggle at all, your role does not carry the permission. ## Step 2: Create a Personal Access Token This is where most setups stall, so here is the exact path. 1. Click your **profile avatar at the bottom-left of the sidebar** 2. Select **Developer Settings** 3. Click **Create Token** 4. Enter a name, for example "Claude Code" 5. Choose an expiry period 6. Click **Create Token** **Copy the token immediately.** It starts with `zn_pat_` and is shown exactly once. Put it in your secret manager, not in a file you might commit. One thing worth understanding before you mint it: the token carries **your** identity, not a narrower one. It can do exactly what you can do in the ZopNight UI, no more and no less, and every call resolves your live role at the moment it is made. If your role changes or you leave the organisation, the token's reach changes with it immediately. So mint it as the person with the narrowest role that does the job. ## Step 3: Copy the server URL On that same Developer Settings screen you will see **MCP Server URL** with a copy button. It also appears in **Settings → Organisation** once the toggle from Step 1 is on. Copy it from there. The URL is specific to your deployment, so use the one the app shows you rather than one from a blog post. ## Step 4: Add the server to Claude Code Open your terminal and run: ```bash claude mcp add zopnight MCP_SERVER_URL -t http -H "Authorization: Bearer MCP_PAT" ``` Replace `MCP_SERVER_URL` with the URL from Step 3 and `MCP_PAT` with the token from Step 2. **The `-t http` flag is not optional.** ZopNight's MCP server uses Streamable HTTP: JSON-RPC 2.0 over HTTP POST, returning either a single JSON response or a Server-Sent Events stream when the client asks for one. It is not WebSocket based. Without the flag, Claude Code treats the URL as a command to run rather than a server to call. Type the URL and token literally, with no angle brackets: `<` and `>` are shell redirection operators and will break the command. ## Step 5: Test with a query Start a new Claude Code session and ask: ```text List my organisations ``` A working connection calls the `list_organisations` tool and returns your organisations by name. Start with this one specifically. `list_organisations` is the only tool that takes no arguments, and every other tool needs the `org_id` it returns, so it separates "is the connection up" from "did I ask the question correctly." If it works, everything after this is a question of permissions rather than plumbing. If it fails, the causes in order of likelihood are: the missing `-t http` flag, a token that was mistyped or has expired, or the organisation toggle from Step 1 still being off. ## Step 6: Confirm what Claude can see Before you point it at anything real, ask: ```text What are my ZopNight permissions? ``` That calls `get_my_permissions` and reports the access your token actually resolves to. You can also ask Claude which ZopNight tools it has: the list it reports is filtered to what your token, your role, and your organisation's settings genuinely allow, so nothing it advertises will fail with a permission error, and nothing you could have called is hidden. This is the step people skip and then get surprised by. Two minutes here tells you exactly what an assistant session can reach. ## What you can ask once it is connected The server exposes **85 read tools** across your estate, so questions like these resolve against live data: - "What are my top idle EC2 instances this week?" - "Show me open recommendations over $500 a month on AWS" - "Which resources are not covered by any schedule?" - "What did our Azure spend do over the last 30 days, and why?" List tools forward the full filter and pagination set (provider, status, region, search, sort), so Claude asks a precise question rather than pulling your whole estate and filtering afterwards. ## What it cannot do Most tools read. How much Claude may change is one setting per organisation, **Write access** in **Settings → Organisation**, with four cumulative levels: Read-only, Metadata only, Reversible changes, and Irreversible changes. At Read-only, Claude can observe your estate and cannot start, stop, or remediate anything. Claude can never exceed the permissions of the person whose token it holds. Some capabilities are excluded at every level and no setting adds them: roles and permissions, user management, organisation deletion, cloud-account deletion, credentials, and bulk actions. `get_service_config` returns environment variable keys with every value redacted, so no tool reveals an env var value for any role. Every write is recorded in the same audit trail as the rest of the API, tagged with a source of `mcp`, so you can see what an assistant changed and when. ## Other clients The same server URL and `Authorization` header work everywhere. **Cursor** and **Codex** have their own setup panels inside ZopNight's Developer Settings, and the [MCP server guide](https://zop.dev/learn/mcp-server) covers every supported client side by side. **Claude Desktop** connects remote MCP servers through its own Connectors interface rather than a config file. ZopNight documents and tests Claude Code, Cursor and Codex, so if you are setting this up for the first time, use Claude Code. Full client-by-client instructions and the complete tool catalogue live in the [MCP server documentation](https://zop.dev/docs/zopnight/integrations/mcp). ## Frequently asked questions ### Do I need admin access to set this up? Only for Step 1. Enabling the MCP toggle needs the Organisation Update permission, so a non-admin has to ask once. Creating your own token and connecting Claude Code needs no special role, and the token grants exactly the access your existing role already has. ### Why does Claude Code need the -t http flag? ZopNight's MCP server uses Streamable HTTP, which is JSON-RPC 2.0 over HTTP POST. It returns a single JSON response, or a Server-Sent Events stream when the client asks for one. It is not WebSocket based. Without the flag, Claude Code treats the URL as a command to run rather than a server to call. ### Can Claude change anything in my cloud accounts? Only as far as you allow. How much an agent may change is one per-organisation setting, Write access, in Settings then Organisation, with four cumulative levels: Read-only, Metadata only, Reversible changes, and Irreversible changes. An agent can never exceed the permissions of the person whose token it holds. ### Does this work with Claude Desktop? Claude Desktop connects remote MCP servers through its Connectors interface rather than the command above. ZopNight documents and tests Claude Code, Cursor and Codex, and each has a setup panel in Developer Settings, so use Claude Code for a first setup. ### How do I revoke access? Delete the token in Developer Settings and the connection stops working immediately. You can also switch the org-level MCP toggle off, which cuts every client at once. Access also narrows on its own if your role changes, since permissions resolve per request against your live role.