Connect an MCP client

Give your MCP client the endpoint. The "Connect an agent" screen of each project shows this prompt with the project name filled in.

Set up a remote MCP server named "my-project" for this project.
Endpoint: https://postdeploy.dev/mcp
Authentication: OAuth.

1. 1

   Step 1. The client opens "Connect to PostDeploy" in your browser. Sign in if asked.

2. 2

   Step 2. Choose the organization, then the project. Only organizations where you are an owner or admin appear.

3. 3

   Step 3. Under "Choose access", clear any permission the client does not need. At least one is required.

4. 4

   Step 4. Select "Allow access". The browser returns to the client, and the project's "Connect an agent" screen shows "Your agent is connected".

An agent on a remote machine, in a container, or in CI cannot open a browser on its own host. Such a client uses the device flow instead. It prints a short code, and you approve on any device.

The client posts to the device authorization endpoint, shows you the user_code and the verification address, then polls the token endpoint until you approve. Permissions and revocation work exactly as above.

curl -s -X POST https://postdeploy.dev/oauth/device_authorization \
  -d client_id=$CLIENT_ID \
  -d resource=https://postdeploy.dev/mcp \
  -d scope='projects:read errors:read'

Open https://postdeploy.dev/activate, type the code, and choose the permissions. The client picks up its tokens on the next poll.

Projects

projects:read, projects:write

Monitor

monitor:read, monitor:write

Errors

errors:read, errors:write

Analytics

analytics:read, analytics:write

Changelog

changelog:read, changelog:write

Status and public pages

status:read, status:write

A call outside the granted permissions fails with an insufficient scope error. Connect again to change them.

The server exposes eight tools. context.get describes the project. actions.search and actions.get find product actions. actions.read, actions.write, actions.publish and actions.destroy run them by class, and confirmations.get reads an approval.

With projects:write and an organization connection, your agent can also create a project, then set up its monitors, error source and analytics key in the same session. A connection pinned to one project cannot create another.

Destructive actions, such as deleting an entry or revoking a key, wait for an owner or admin. Approve or reject them under "Pending confirmations" on the project's "Connect an agent" screen.

1. 1

   Step 1. Open Organization Settings and find "Connected MCP Clients".

2. 2

   Step 2. Select "Revoke" on the client, type its name, and select "Confirm revoke". Its tokens stop working at once.

An unauthenticated request to the endpoint returns 401 with a WWW-Authenticate header that points to the protected resource metadata. The authorization server supports client ID metadata documents and dynamic client registration, authorization code with S256 PKCE, and public clients without a secret.

curl -s https://postdeploy.dev/.well-known/oauth-protected-resource/mcp
curl -s https://postdeploy.dev/.well-known/oauth-authorization-server

Access token

Starts with mcoat_, lasts 1 hour, sent as Authorization: Bearer.

Refresh token

Starts with mcort_, lasts 30 days, and rotates on every refresh. Store each new refresh token. If your client loses a token response, it can present the previous token again for 60 seconds and get a new pair. After that window, a used refresh token revokes the whole connection.

Resource

Send resource=https://postdeploy.dev/mcp exactly, on authorization and token requests.

Revocation

POST https://postdeploy.dev/oauth/revoke with the token. Revoking the refresh token also ends its access token.

Access stops after about an hour

The client did not refresh. Reconnect, or update a client that does not refresh tokens.

Every call returns 401 after a refresh

A used refresh token was sent more than 30 seconds after it was replaced, which revokes the connection. Store each new refresh token, then connect again.

The organization is missing on the consent screen

You are not an owner or admin there. Ask an owner to change your role.

A delete never completes

Destructive actions wait for approval. Open the project's "Connect an agent" screen and select "Approve".

The device flow answers authorization_pending

Nobody approved the code yet. Keep polling at the advertised interval. A slow_down answer means you polled faster than that.