Skip to main content
The Sidecars MCP server is a remote, streamable-HTTP MCP server. There is one URL, no API key, and no secret to paste into a config file. Sign-in happens through the standard MCP OAuth flow in your browser. The fastest way in is to let the agent you already have do the setup. The prompt works in any agent that manages its own MCP configuration. An agent that cannot configure the connection itself will walk you through the settings below instead.

Manual setup

The Developers page inside the app (sidebar → Developers, or sidecars.ai/developers) shows the exact URL for your deployment. The commands below are the same ones that page generates, with the production URL filled in. The URL is for MCP clients; opening it in a browser shows an error.

Per-host setup

Then run /mcp inside Claude Code, choose sidecars and pick Login.Or add it by hand to .mcp.json in your project (or ~/.claude.json):

Any other host

  • Cross-agent installer: npx add-mcp https://mcp.sidecars.ai/mcp
  • Hosts that cannot speak streamable HTTP: npx -y mcp-remote https://mcp.sidecars.ai/mcp

What happens on first use

1

Discovery is public

initialize, ping, tools/list and resources/list answer without a token, so a host can show the tool catalogue before you sign in.
2

The first tool call is challenged

The first tools/call returns 401 with a WWW-Authenticate challenge. The host reads the server’s protected-resource metadata, discovers the authorization server, and opens a browser tab.
3

Sign in and pick a workspace

You sign in (or sign up) and land on the consent screen, where you choose the workspace this connection acts in. A brand-new account can create its workspace right there.
4

The call is retried with a token

The host stores the access token and retries. Tokens expire after 24 hours; the host refreshes or re-prompts as needed.
Scopes are granted incrementally. A first connect asks only for identity and knowledge:read. The first time an agent calls a document, page, comment or export tool, the server answers 403 insufficient_scope naming the missing scope and the host re-runs consent for it. See Authentication and access.

Advanced setup