MCP Server

SolidHooks runs an MCP server at https://api.solidhooks.com/mcp. Point an MCP client such as Claude, Claude Code, Cursor or VS Code at it and the client can manage your sources, destinations, connections and deliveries. There is nothing to install and no key to store.

Agent Auth is the recommended way to give an agent access, because you approve each capability it gets. Use the MCP server when you want to connect an MCP client quickly and are comfortable with it acting with your full role.

What happens when you connectCopy Anchor Link

1. Add https://api.solidhooks.com/mcp to your client as a remote MCP server.
2. The client opens your browser. Sign in to SolidHooks if you are not already.
3. A consent screen asks whether to allow the app to use SolidHooks as you. It shows where the app comes from, the account you are signed in as, and each organization it can reach with your role in it. Click Allow.
4. The browser hands control back to the client, and it is connected.

Click Deny and nothing is connected.

You do not register the client or create credentials first. A client identifies itself with a Client ID Metadata Document, an HTTPS URL it publishes, and SolidHooks does not offer dynamic client registration. A client that cannot do this cannot connect.

Use it with ClaudeCopy Anchor Link

Claude on the web, desktop and mobileCopy Anchor Link

1. In Claude, open Customize, then Connectors, and choose Add custom connector.
2. Name it SolidHooks and enter https://api.solidhooks.com/mcp as the URL.
3. Click Connect. Sign in to SolidHooks in the window that opens, and click Allow on the consent screen.

The connector is then available in your conversations on claude.ai, Claude Desktop and the Claude mobile apps.

Claude CodeCopy Anchor Link

Add the server from your terminal:

claude mcp add --transport http solidhooks https://api.solidhooks.com/mcp

Then start Claude Code, run /mcp, choose solidhooks and authenticate. Your browser opens the same sign-in and consent screens.

What to askCopy Anchor Link

Start by asking Claude to list your organizations and pick a project, or just ask a question and it will do that first. Then try:

• "Which deliveries failed in the last 24 hours, and what did the destination return?"
• "Create a GitHub source with my webhook secret, a destination that posts to https://example.com/hooks, and connect them."
• "Replay the last failed event to its connections, then tell me whether the new deliveries succeeded."
• "How much of this month's delivery quota have I used, and when does it reset?"

Claude runs read-only tools, such as listing deliveries, without asking. It asks you to approve each destructive call, such as a replay, a secret rotation or a delete, before it runs. Replaying an event creates new deliveries, which count toward your plan's usage.

It acts as you, with your full roleCopy Anchor Link

An MCP client does not get a narrow set of permissions. Its token acts as you, with your role in every organization you belong to, and your role is checked again on every call. The consent screen says the same: where you are an owner or admin, the app can delete resources, rotate secrets and change billing. It can also see your name and email address.

Because the role is read live, changes follow you. If you are demoted, or removed from an organization, the client's access changes on its next call.

This is the trade-off against Agent Auth. Agent Auth gives an agent its own identity and only the capabilities you approve one by one. The MCP server is quicker to set up and has no per-capability scopes. Use Agent Auth when an agent should do less than you can.

Pick a projectCopy Anchor Link

Every tool except the two below needs a project. A new connection has none selected, and operations refuse with NO_PROJECT_SELECTED until one is.

1. The client calls account.get_memberships. It returns the organizations you belong to, your role in each, and their projects.
2. It asks you which project to work in, then calls account.select_project with that project's id.

The choice is remembered for that app and your account, so the client does not send it again on later calls. Ask the client to call account.select_project again to switch projects.

Once a project is selected, the client sees only the tools your role in that organization allows. Hiding a tool is not what protects you: each call is checked against your role anyway. A refused call comes back as a tool error carrying the API's own code, such as FORBIDDEN.

The tools themselves are the same operations Agent Auth offers: one per API operation, named by its operationId, such as sources.list. A few are left out, and stay available through the API and Agent Auth:

• events.stream and deliveries.stream, because a tool result cannot carry a live stream.
• connectors.bootstrap and connectors.heartbeat, which a connector replica calls with its own credential.
• health.check and countries.list.
• destinations.revealSigningSecret, which would put a plaintext secret into the conversation.
• billing.changePlan, because an upgrade charges your card immediately. Change plans in the dashboard. The client can still price a change with billing.previewPlanChange.

Every tool has a title and says what kind of call it is. Read-only tools change nothing, so a client can run them without asking. Tools that update, delete, disable, rotate a secret, change billing or send a webhook again are marked destructive, so a client such as Claude asks you before each call. Creating something is neither.

When a call is refused for bad input, the error lists each field that failed and why, so the client can correct the call.

How access endsCopy Anchor Link

An app stays connected until you revoke it. Open your account settings, choose Connected apps, and revoke the app. The app's next call then fails with 401 invalid_token and the message that access has been revoked, even if its token has not yet expired. The client has to start the sign-in again.

The same happens if your account is banned. Being removed from an organization also cuts an app's access to that organization on its next call.

TroubleshootingCopy Anchor Link

A refused call comes back as a tool error carrying a code. These are the ones you are most likely to see:

Still stuck? Email support@solidhooks.com with the tool you called and the code it returned.