MCP (Model Context Protocol)

Quave ONE MCP lets an AI client work with your Quave ONE account through a remote, authenticated MCP server. Ask your client to inspect logs, review a deployment, manage an environment, or run an approved Job without giving it unrestricted access to your infrastructure.

AI client → Quave ONE MCP server → Quave ONE API → your account resources

The MCP server validates identity, capabilities, account permissions, and tool-specific rules before an operation reaches the Quave ONE API. Results return to the AI client as MCP responses.

Choose how to connect

Method	Best for	How it works
OAuth	Clients that support remote MCP OAuth	The client opens Quave ONE consent and receives its own scoped tokens.
MCP key	Existing integrations or clients without OAuth support	You create a separate key and configure it in that client’s Authorization header.

OAuth is the recommended connection method. MCP keys remain supported unless an account administrator enables Require OAuth for automated API and MCP access for that account. That setting affects automated credentials only; it does not affect dashboard sign-in.

Start here

1. Connect your client with OAuth or an MCP key.
2. Choose server-enforced authorization: capabilities, or an explicit MCP tool allowlist for OAuth grants and MCP keys.
3. Review available tools and use least privilege.
4. Keep management, troubleshooting, and FAQ handy.

What Quave ONE enforces

The server enforces the authorization grant or key configuration, Quave ONE account and environment permissions, and tool-specific checks. Client-facing confirmation prompts and approval-session duration are helpful UX safeguards, but depend on the MCP client.

Security Best Practice: Grant only the access shape you need. Use By permissions for capability-scoped access, or By tools when you want an explicit MCP tool allowlist. The server blocks every other operation regardless of how the MCP client is configured.

For API automation that is not MCP, use the Public API instead. OAuth tokens are resource-bound: an MCP token can only open MCP sessions, and a Public API token can only call the Public API.

For Job automation, run-app-env-job creates customer-visible JobRuns and list-app-env-job-runs returns a paged list. Use page and limit for pagination, status for one status or comma-separated statuses, and from / to for createdAt time filters.

update-app-env-resources can increase the disk allocation after it has been applied for managed databases and regular apps with a local persistent volume. Disk decreases are rejected because persistent volumes are grow-only. Shared NFS volumes and stateless apps do not use this disk setting. Use list-database-presets for the current managed-database min/max limits. For eligible Quave ONE Direct environments, storage overage uses this configured local disk allocation, including regular apps with a local persistent volume.

When checking deployment progress with get-app-env-status, use currentDeployment for the content version currently attached to the environment and latestDeployment for the newest build or deploy activity. For source deploys, latestDeployment.status can be BUILDING before that version becomes current. CLI source deploy content can also expose latestDeployment.uploadEventId so tooling can correlate polling with the exact upload event.