Docs / Product MCP

Connect your agent to Kitecraft

Connect Claude, Cursor, Codex, or another remote MCP client to project evidence, work packets, and receipts. Every call remains tenant-scoped, policy-checked, and audited.

Endpoint

https://kitecraft.ai/api/mcp

Reads do not spend provider budget. Paid tools quote first and run only after exact confirmation.

OAuth Setup

Open Settings, then MCP.
Choose a client preset for Claude, Cursor, Codex, OpenCode, or another remote MCP client.
Copy the OAuth config. It contains only the hosted URL and no secret.
Let the client open Kitecraft in the browser, sign in, and approve the MCP consent screen.

OAuth is the primary path. Remote clients can use Dynamic Client Registration and PKCE `S256`.

Open MCP Setup

Client Presets

Claude

Add a custom connector with the hosted URL. Claude discovers Kitecraft OAuth and opens consent.

Use OAuth. Do not paste a bearer token into Claude.

Cursor

Add Kitecraft as a Streamable HTTP remote MCP server. Cursor uses OAuth for remote servers.

Use bearer fallback only if OAuth discovery fails.

Codex

Run `codex mcp add kitecraft --url https://kitecraft.ai/api/mcp`, then `codex mcp login kitecraft --scopes product_mcp`.

Older builds can read `KITECRAFT_MCP_TOKEN` from the environment.

OpenCode

Add a remote MCP entry in `opencode.json`, then run `opencode mcp auth kitecraft`.

Disable OAuth only when the client must read a locally stored token.

{
  "mcpServers": {
    "kitecraft": {
      "url": "https://kitecraft.ai/api/mcp"
    }
  }
}

codex mcp add kitecraft --url https://kitecraft.ai/api/mcp
codex mcp login kitecraft --scopes product_mcp

MCP Setup can copy an agent setup prompt with the endpoint, client config, and safe read-only calls. Prefer explicit tenant and project ids. Domain lookup works only when it resolves to one accessible project.

Advanced Bearer Fallback

Use bearer tokens only for clients or harness versions that cannot complete remote MCP OAuth yet. Create tokens in Settings, then MCP. The raw token is shown once; Kitecraft stores only a hash, a safe prefix, status metadata, and hashed last-used request metadata.

{
  "mcpServers": {
    "kitecraft": {
      "url": "https://kitecraft.ai/api/mcp",
      "headers": {
        "Authorization": "Bearer <read KITECRAFT_MCP_TOKEN from local secret storage>"
      }
    }
  }
}

Do not paste bearer tokens into agent chat. Store the token as `KITECRAFT_MCP_TOKEN` or in the client secret store, and use the secretless setup prompt so the agent reads it locally. Tokens default to a 90-day expiry; use no expiry only for a stable trusted client and revoke it if the client is replaced or the token is lost.

Production Requirements

Set `KITECRAFT_MCP_OAUTH_SIGNING_SECRET` in production so OAuth clients and authorization codes can be signed.

Keep `https://kitecraft.ai/api/mcp` publicly reachable over HTTPS for remote MCP clients and browser consent callbacks.

Safety Boundary

The model does not decide what is legal. Kitecraft supplies the allowed set, then rechecks every confirmed action against tenant policy.

Tokens are tenant-bound, revocable, rate limited, and rechecked against current workspace membership.

Tenant mode hides raw USD, raw tokens, provider payloads, hidden prompt variables, trace ids, and evaluator diagnostics.

Paid and intelligence tools are estimate-first and require explicit confirmation fields before execution.

Confirmed paid calls use a short execution lock to reduce duplicate-spend retries.

Safe First Calls

Start read-only. These tools return project state, readiness, the canonical operator decision, and supporting Rank evidence without authorizing spend or external effects.

kc_rank_dashboardkc_report_weeklykc_project_statekc_project_readinesskc_project_usagekc_fixpack_candidateskc_content_strategy_workspacekc_content_campaign_workspacekc_content_campaignskc_content_territory_suggestionskc_tracking_readinesskc_connectors_status

Growth Operator Skill

Install the Growth Operator skill to start with the weekly delta, present the canonical decision, request exact approval when required, and return the receipt.

docs/skills/kitecraft-growth-operator/SKILL.md

Put the folder in your client's skills directory, then start a weekly operator session.