AI agents (MCP)

ZedCloud speaks the Model Context Protocol (MCP), so AI agents can read your canvas, add nodes, write code and prepare deploys. Every change they make is staged, the same as yours: nothing runs until a person presses Deploy, unless you explicitly let the agent deploy.

Connect

Claude Code

claude mcp add --transport http zedcloud https://mcp.<platform host>/mcp

Then run /mcp, pick zedcloud and Authenticate.

Claude.ai, Cursor, VS Code

Add a remote MCP server (Streamable HTTP) with the URL https://mcp.<platform host>/mcp. There’s no client ID or secret to paste: the client registers itself and opens the dashboard for you to sign in.

Local (zc mcp)

With the CLI and a token:

claude mcp add zedcloud --env ZC_TOKEN=zcp_... -- zc mcp

Or in any client’s config:

{"mcpServers": {"zedcloud": {"command": "zc", "args": ["mcp"], "env": {"ZC_TOKEN": "zcp_..."}}}}

The local server can also upload a folder from your disk.

What you agree to

The dashboard shows a consent screen with:

• which app is asking, and where it will send you back. The name is whatever the app calls itself, so check the address.
• the workspaces it may use.
• what it may do:

Permission	Allows
read	See workspaces, nodes, plans, templates and app code
logs:read	Read logs. Logs can contain text written by anyone, including attackers
resources:write	Stage new nodes, edits and links
resources:delete	Stage deletions
deploy (off by default)	Deploy the exact plan it showed, push code, roll back
sandbox (off by default)	Use throwaway Linux machines to build and test

The agent acts as you, within those permissions and your role. Lower your role or remove yourself from a workspace and the agent loses that access too. It never sees secret values or tokens.

Caution

Anything the agent reads (logs, notes, labels, code) can try to give it instructions. Grant only what the task needs.

What agents can do

• Build a stack: create nodes and links, set config and env, use a template, apply a manifest.
• Write code: list and read an uploaded app’s files, push changed files, or publish the code to a GitHub repository. For GitHub-linked apps, the agent works in the repository instead.
• Diagnose: read status, the diagnosis and logs.
• Deploy: with deploy, an agent reads the plan with preview_deploy and deploys it by its hash. If the plan changed in the meantime the deploy is refused. Workspaces that require approval still wait for a person.

Try asking: “Add a Postgres database to my api app, link them, and show me the deploy plan.”

Sandboxes

Where offered, the sandbox permission gives an agent disposable Ubuntu machines (root, Docker, outbound web only, no access to your other nodes). It can pull an app’s code into one, install, build and run tests, then push the result back: an uploaded app is rebuilt; a GitHub-linked app gets a branch zc-sandbox/<id> for you to review and merge.

A sandbox is deleted 2 hours after it starts (agents can extend to 24), after 30 minutes without a command, or when you delete it in Profile → Agent sandboxes.

Revoking

Profile → Connected apps → Revoke ends the connection and all its tokens at once. In Claude Code, claude mcp logout zedcloud forgets the sign-in. Every action an agent takes is in the workspace’s activity log, marked as coming from MCP.