> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aireserve.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP server

> Give your agents account operations — live catalog, analytics, key and team management, one-shot inference — over one hosted MCP endpoint.

<Card title="Connect the MCP server in the portal →" icon="zap" href="https://aireserve.com/connect/mcp" horizontal>
  The guided connect page mints a scoped MCP access token and walks you through your client's config.
</Card>

AI Reserve also ships a hosted, remote **MCP server**, so the agents you just connected can
operate your *account* — not just spend your tokens. Over one streamable-HTTP endpoint your
agent gets the live model catalog with pricing, usage analytics, team and API-key management,
and one-shot inference — all as the connected user, bounded by what that user's role already
allows. Any MCP client that speaks streamable HTTP with a bearer header works; Claude Code,
Codex, and Cursor are spelled out below.

```shell theme={"dark"}
POST https://api.aireserve.com/mcp
Authorization: Bearer aireserve_mcp_…   # an MCP access token — NOT an inference key
```

**Credentials.** MCP access tokens are minted on the
[portal profile page](https://portal.aireserve.com/profile#mcp-tokens) (Profile → MCP access tokens):
explicitly scoped (`mcp:read`, `mcp:write`, `mcp:messages`), always expiring, revocable, and
shown once. Inference keys (`aireserve_api_…`) are deliberately refused at this endpoint — a
leaked inference credential must never gain management powers. Export the token once and let
every config below read it from the environment, so no secret lands in a file that might get
committed:

```shell theme={"dark"}
export AIRESERVE_MCP_TOKEN="aireserve_mcp_…"   # ~/.zshrc or a secrets manager
```

## Claude Code

```shell theme={"dark"}
claude mcp add --transport http aireserve https://api.aireserve.com/mcp \
  --header "Authorization: Bearer $AIRESERVE_MCP_TOKEN"
```

Default scope is the current project; add `-s user` for all your projects. For a committable
project config use `.mcp.json` — `${AIRESERVE_MCP_TOKEN}` expands from the environment:

```json theme={"dark"}
{
  "mcpServers": {
    "aireserve": {
      "type": "http",
      "url": "https://api.aireserve.com/mcp",
      "headers": { "Authorization": "Bearer ${AIRESERVE_MCP_TOKEN}" }
    }
  }
}
```

Verify with `claude mcp list` (or `/mcp` in a session). Tools surface as
`mcp__aireserve__…` — try `mcp__aireserve__whoami`.

## Codex

`codex mcp add` only handles stdio servers; remote HTTP servers go in
`~/.codex/config.toml`, with the bearer token referenced by environment variable. The same
config is honored by the Codex CLI, the IDE extension, and the ChatGPT desktop app:

```toml theme={"dark"}
[mcp_servers.aireserve]
url = "https://api.aireserve.com/mcp"
bearer_token_env_var = "AIRESERVE_MCP_TOKEN"
```

Codex reads the variable at launch — restart Codex after exporting it, then verify with
`codex mcp list`.

## Cursor

`~/.cursor/mcp.json` (global) or `.cursor/mcp.json` (per project). Note Cursor's env
interpolation is `${env:VAR}` — not Claude Code's `${VAR}`:

```json theme={"dark"}
{
  "mcpServers": {
    "aireserve": {
      "url": "https://api.aireserve.com/mcp",
      "headers": { "Authorization": "Bearer ${env:AIRESERVE_MCP_TOKEN}" }
    }
  }
}
```

## What agents can do — and what they can't

<CardGroup cols={2}>
  <Card title="Live, role-bounded tools" icon="shield-check">
    The tool list is computed per request from the connected user's live role and the token's
    scopes — an analyst and an admin literally see different tools, and revoking the token
    (profile page) applies on the next request. Fixed extras: `whoami`, `list-models`,
    `get-model`, and `send-message` — one-shot inference, metered and billed like every other
    request.
  </Card>

  <Card title="Consent & secrets" icon="lock">
    Sensitive writes take a two-step confirm round-trip before executing. Operations that
    return secrets — minting an API key, say — never hand the secret to the model: the agent
    receives a signed portal link, and the secret renders in your signed-in browser only.
  </Card>
</CardGroup>