# MCP server

> Unrent’s MCP server is `https://mcp.unrent.dev/mcp` (Streamable HTTP, protocol revision 2026-07-28, OAuth 2.1). Your coding agent can read your servers, services, deployments, logs and metrics, and ask for changes; every change waits until a person approves it with a passkey.

URL: https://unrent.dev/docs/mcp/

## Connect

Claude Code:

```
claude mcp add --transport http unrent https://mcp.unrent.dev/mcp
```

Other clients: add an HTTP MCP server with the URL `https://mcp.unrent.dev/mcp`. The client discovers sign-in on its own. It must speak revision 2026-07-28; older clients that send `initialize` get an error naming the supported version.

On first use your browser opens [app.unrent.dev](https://app.unrent.dev). You choose **one** organisation and the scopes to grant; the page shows how the client described itself, marked unverified.

## Scopes and tools

MCP scopes and tools

| Scope | Tools | Role needed |
| --- | --- | --- |
| `read` (always) | `list_servers`, `list_services`, `get_service`, `list_deployments`, `get_deployment`, `get_metrics`, `get_job`, `get_logs` | viewer; `get_logs` needs developer |
| `deploy` | `deploy` | developer |
| `operate` | `restart`, `stop`, `start`, `rollback` | developer |

Your current role is checked on every call, so demoting or removing a member takes effect at once. There is no tool that creates or deletes anything; services are created by a person in the console.

## Every change waits for a passkey

1. **The agent asks.** A change tool returns `status: "approval_required"` with a `job_id`, the job’s SHA-256 `digest` and an `approve_url`.
2. **A person reviews.** The approval page is drawn from the signed job (kind, server, resource, parameters), never from text the agent wrote, and names the app that asked.
3. **Approve with a passkey.** The approver signs that digest. Only then is the job delivered to the server. With the two-person rule on, the member whose agent asked cannot approve it.
4. **Follow it.** The agent polls `get_job` until `succeeded` or `failed`. A job nobody approves expires after 10 minutes.

Clients that support URL elicitation get the approval link as an `input_required` result and can wait for it.

## Output is data, not instructions

`get_logs` returns a summary by default (levels, distinct messages with counts); `raw: true` adds up to 64 KiB of lines. Control characters, escape sequences and credentials are stripped, and the result says that log text is untrusted.

## Revoke access

**Settings → Connected apps** lists each connected app, who connected it, its scopes and when it was last used. Members revoke their own; admins and owners can revoke anyone’s. Access tokens last 1 hour; each refresh token works once.

## Questions

### Can an agent delete my database through MCP?

No. There is no delete tool, and every change it can ask for is held until a person approves that exact job with a passkey.

### Does Cursor work?

Clients must use https or a loopback address for their sign-in redirect, as the MCP specification requires. Clients that register custom URL schemes are refused for now.

### Is there a rate limit?

Yes: 120 requests per minute per connected app, then 429 with Retry-After.