Skip to main content

Connect an MCP client

The hosted Quave ONE MCP endpoint is:

https://mcp.quave.cloud/

It uses remote Streamable HTTP; it does not run a local STDIO server or execute commands on your computer.

Use OAuth when your MCP client supports remote MCP authorization. You do not need to create or paste an MCP key.

  1. Add the Quave ONE MCP endpoint in the client.
  2. Let the client discover the authorization server and begin its OAuth flow.
  3. Sign in to Quave ONE, verify the application and callback origin, then choose By permissions or By tools on the consent screen.
  4. Approve the minimum access required. Read-only is the default starting selection when the client requested only read access, but verified clients can present the full capability set for an explicit step-up. The client receives its own scoped token and connects.

Quave ONE uses OAuth 2.1 with PKCE. Dynamic Client Registration is accepted only for clients whose complete callback URI set matches a trusted profile exactly. A client without a trusted callback profile needs a Quave ONE administrator to register its exact callback profile or provide a static client ID before it can connect.

Supported client registration paths​

Most users should not need to paste a client ID:

  • Trusted remote MCP clients such as supported Claude and Cursor flows use Dynamic Client Registration. Add https://mcp.quave.cloud/ in the client and leave any optional Client ID field empty unless Quave ONE support tells you otherwise.
  • Manually registered clients use a static client ID created by a Quave ONE administrator. This is for new or custom clients whose callback URI set has not yet been added as a trusted Dynamic Client Registration profile.

If a supported client asks you to provide a client ID after failing to register, do not create an MCP key as a workaround. Verify the endpoint URL first, then share the client’s registration reference or callback URI set with Quave ONE support so the trusted profile can be corrected.

The OAuth consent screen always creates one server-enforced authorization mode:

  • By permissions grants Quave ONE capability scopes, such as read-only, deploy, configuration, secret-reading, dangerous operations, MCP-key management, or admin operations.
  • By tools grants only the selected MCP tools. The selector is grouped and searchable like the MCP-key tool selector. New tools are not added automatically.

The default selection matches the client’s request. Verified clients may show a larger available ceiling so you can explicitly approve more access during the connection. Existing connected apps can be reduced or revoked; to add permissions, add tools, or switch modes, reconnect the client and approve a new OAuth request.

Manage OAuth access​

Open User Menu → MCP → Connected apps to view the app, callback origin, current authorization mode, connection time, and last use. Revoke access there or reduce access inside the current mode. To add permissions, add tools, or switch between By permissions and By tools, reconnect from the client and approve the new consent request.

OAuth capabilities are stable Quave ONE permissions such as quave:read and quave:write:deploy, rather than one OAuth scope per tool. A grant is either permission-based or tool-based; Quave ONE does not mix those modes for new connections.

API and MCP OAuth are separate

An OAuth token issued for the MCP resource can only open an MCP session. A Public API OAuth token cannot be used for MCP. An integration that needs both must obtain separate grants; both appear in Connected apps.

MCP keys​

Use a key for a legacy integration or a client that cannot use OAuth. Create a different key for each device or client so you can identify, rotate, disable, or revoke it independently.

  1. In Quave ONE, open User Menu → MCP and select Create MCP Key.
  2. Give it a recognizable name.
  3. Choose By permissions or By tools, then grant only what that client needs. See Security and authorization.
  4. Copy the key immediately. Quave ONE does not show the plaintext key again.
  5. Configure the key as the raw value of the Authorization header — do not prefix it with Bearer.

Generic configuration​

URL: https://mcp.quave.cloud/
Authorization: YOUR_MCP_KEY

Cursor with an MCP key​

{
  "mcpServers": {
    "quave-one": {
      "url": "https://mcp.quave.cloud/",
      "headers": {
        "authorization": "YOUR_MCP_KEY"
      }
    }
  }
}

Claude Code with an MCP key​

claude mcp add --transport http --scope user quave-one https://mcp.quave.cloud/ \
  --header "authorization: YOUR_MCP_KEY"

For a project-only Claude Code configuration, use --scope project instead of --scope user. Other clients use the same endpoint and raw Authorization header convention.

note

MCP keys are for MCP only. They cannot call the Quave ONE Public API directly; use an API token or Public API OAuth for that.

OAuth-only account policy​

An account administrator can enable Require OAuth for automated API and MCP access. When enabled, legacy MCP keys and legacy API tokens are rejected for that account’s resources, while dashboard access remains unchanged. Existing keys and tokens are not deleted; disabling the policy restores their legacy use. OAuth-only does not require MFA from the acting administrator.