Remote MCP

Plug your AI coding assistant into Launchmatic over OAuth. Claude Code, Cursor, Codex, OpenCode, GitHub Copilot — anything that speaks the Model Context Protocol can drive your services with scoped, revocable access. No API keys to paste.

Connect your client

Claude Code
terminal
claude mcp add launchmatic --transport http https://mcp.launchmatic.io
Cursor — .cursor/mcp.json
json
{
  "mcpServers": {
    "launchmatic": { "url": "https://mcp.launchmatic.io" }
  }
}
Codex / OpenCode / Copilot
config
# Configure an HTTP-transport MCP server pointing at:
https://mcp.launchmatic.io

On first use the client opens a browser to mcp.launchmatic.io/oauth/authorize. You sign in with GitHub, pick which workspaces to grant access to, and approve. The client gets a scoped Bearer token; nothing is copy-pasted, and you can revoke per-app from Settings → Connected Apps at any time.

Available tools

toolrequired scopedoes
whoamimcp:toolsIdentity, granted scopes, accessible teams. Use first to verify the connection.
list-projectsprojects:readProjects the OAuth grant covers.
list-servicesprojects:readServices in a project, with status of the latest deployment.
get-serviceprojects:readFull service detail: config, recent deploys, env keys (NOT values), domains.
list-deploymentsprojects:readDeployment history for a service.
get-deploymentprojects:readStatus, timing, build logs for a single deployment.
redeploydeployments:writeTrigger a fresh build + deploy on the configured branch (or override).
cancel-deploymentdeployments:rollbackHalt a running build/deploy.
set-env-varsenvvars:writeBulk set/update environment variables. Run redeploy after.
add-domaindomains:writeRegister a custom hostname; SSL provisions automatically.
get-logslogs:readSnapshot of runtime logs from the running pod (or last build log if no pod).
launchmatic-agentmcp:toolsMeta-tool: send one fuzzy request, get a consolidated multi-step answer back.

The 11 concrete tools are deliberately consolidated — every tool definition costs context on every turn the client makes. The launchmatic-agent meta-tool lets a client delegate a fuzzy multi-step request ("why is my api crashing", "add postgres and wire it up") and get one synthesized answer back, instead of orchestrating 4-6 round-trips themselves.

Scopes

New clients default to read-only (mcp:tools + projects:read + logs:read). Write capabilities are opt-in per scope.

mcp:toolsCall MCP tools. Required for any client to connect.
projects:readRead projects, services, deployments, env keys, domains.
logs:readRead runtime + build logs.
services:writeCreate / modify services.
envvars:writeSet / delete environment variables.
domains:writeAdd / remove custom domains.
databases:writeCreate / link / delete managed databases.
deployments:writeTrigger new deployments.
deployments:rollbackCancel running deployments and roll back.
offline_accessIssue a refresh token so the client can stay connected.

Token usage & quota

Agent calls consume Anthropic tokens that Launchmatic bills against your plan. Quotas:

planmonthly tokens
FREE100K
PRO1.5M
TEAM8M

Per-day soft caps and per-team aggregates kick in before you hit the monthly cap so a runaway session can't burn the whole quota. Track live in Settings → AI Usage.

Revoke access

Open Settings → Connected Apps to see every app you've granted access to, what scopes it has, when it last called a tool, and a one-click revoke. Revocation is immediate — the next tool call from the revoked client gets HTTP 401.

Standards

  • OAuth 2.1 with PKCE-only public clients (RFC 6749, 7636)
  • Dynamic Client Registration (RFC 7591) so clients self-register on first connect
  • Authorization Server Metadata at /.well-known/oauth-authorization-server (RFC 8414)
  • Protected Resource Metadata at /.well-known/oauth-protected-resource (RFC 9728)
  • Token Revocation (RFC 7009) at /oauth/revoke
  • OIDC userinfo at /oauth/userinfo for clients that already speak OIDC
  • MCP Streamable HTTP transport with optional stateful sessions