MCP
The same API for an agent, authenticated with the same key. What it does not touch, and what it can still read.
https://your-instance/mcp is the same API for an agent, authenticated
with the same key. Point Claude Code, Cursor or whatever you run at it:
{
"mcpServers": {
"cubeship": {
"type": "http",
"url": "https://cubeship.example.com/mcp",
"headers": { "Authorization": "Bearer <your-api-key>" }
}
}
}That URL is the instance (the daemon), path /mcp — the same host
you open in a browser, not a separate dashboard port such as :3000.
Auth is the API key in Authorization only: there is no MCP OAuth.
In Cursor, put the block in ~/.cursor/mcp.json (or the project's
.cursor/mcp.json) and do not add an auth / OAuth section. Make a key
under Account → API keys (or
cubeship user api-key create cursor).
From there it can create a project, deploy an app, read the logs and how the last deploy ended, attach a database and set the variables, and install or update a template — the work of the dashboard, without the dashboard. It is stateless on purpose: every call carries the key, so nothing an agent opened can be picked up by another.
To let an agent read these docs as well, add
cubeship.dev/mcp beside it.
An app's variables are readable, secrets included
get_app_env returns every variable an app's container runs with, and
the values come with them. An attached database contributes
DATABASE_URL and DATABASE_PASSWORD, and any secret you set on the app
is there too. Treat a key an agent holds as able to read them.
What it does not do
No tool sets a container's ceiling, and none opens a port to the internet: no tool exposes a database or a store, writes DNS or firewall rules, reads a bucket's contents, reads a credential, adds or removes a machine, or manages users. Those stay with a person, at the dashboard or the CLI. Every tool that exists is in the tool reference.
What the key allows
An agent holds an API key, and a key has its owner's role. A member deploys published images; an admin also builds source on the host and configures the instance. Give an agent a member's key unless it has business doing the other thing.