Managed remote MCP server for your AI agents

01What it is

The Model Context Protocol is the standard by which an assistant discovers and calls external tools. A remote MCP server is reachable over HTTP: nothing to install, nothing running on your machine, and the same connection works from anywhere you authenticate.

Zerolith's MCP server runs on exactly the same code as the REST API and the web app. There is no privileged path reserved for agents, so an MCP tool can never do something your account itself cannot.

02Connecting a client

The transport is HTTP. Point your client at the URL above; OAuth 2.1 authorization kicks in on the first connection, in your browser.

Claude Code

One command. Your browser opens for authorization, then the tools show up in the session.

claude mcp add --transport http zerolith https://zerolith.io/mcp

Cursor, VS Code and other clients

File-configured clients accept this block; the file name and location vary from one client to the next.

{
  "mcpServers": {
    "zerolith": {
      "type": "http",
      "url": "https://zerolith.io/mcp"
    }
  }
}

Step-by-step tutorial with Claude Code »

03Authentication and revocation

Access goes through OAuth 2.1: no API key to paste into a client config, so no long-lived secret sitting in a file.

• Dynamic client registration (RFC 7591): your agent registers itself. There is no application credential for you to create, copy or store anywhere.
• PKCE with S256, mandatory: an intercepted authorization code is useless without the verifier, which never leaves your agent.
• Audience-bound tokens (RFC 8707): a token issued for zerolith is worth nothing elsewhere, and a token issued for another service is worth nothing here. Even stolen, it does not open the wrong door.
• Refresh-token rotation: each renewal invalidates the previous one, so a stolen token that is replayed announces itself.
• Two scopes, no more: mcp:read to look, mcp:write to act. A requested scope we do not recognise is refused, never silently widened.

Revocation: changing your password immediately invalidates live MCP grants (refresh tokens and unused authorization codes), on top of your web sessions.

04What an agent can do

Connecting an agent delegates actions, not your secrets. Here is how far it can go, and what it will never see.

• It acts only inside your account. Every tool is bounded to your own resources: asking for the id of a function you don't own answers "not found" and never "forbidden". We don't even confirm it exists.
• Your API keys stay invisible. They are stored hashed and shown once, at creation, in the dashboard. No MCP tool returns them, and the agent doesn't need them: it authenticates with its own token.
• So do your secrets. A secret environment variable is written to the cluster and never read back: the agent can create, replace or delete it, but not read its value. Neither can you, for that matter.
• Your database token and your storage keys don't travel either. The agent can create the database, attach it to a function, run your migrations or trigger an export without ever receiving the credential that opens it.
• State-changing actions declare themselves. Every tool states whether it writes, which lets your MCP client ask you to confirm before letting the agent act.

You cut access whenever you decide, from the MCP page of your dashboard. Revocation immediately invalidates the access token already issued, not just its renewal: otherwise an agent would keep control until the token expired while the dashboard said "disconnected". Resetting your password also cuts every live MCP session.

An agent can also manage your database end to end, without ever seeing its credentials →

05The tools it exposes

41 tools, all scoped to your account. The descriptions below are the ones the server advertises to your client, word for word: the contract the agent reads.

19 of these cover private databases, an optional feature. Where a deployment has it off, they are neither advertised by tools/list nor callable.

06What the agent cannot do

The MCP server is not admin access. It is bound by the same rules as the rest of the platform:

• Account scope only: a resource you don't own answers 404 and never 403, so the agent can't even learn it exists.
• Write operations require a verified account, and are refused once credit runs out.
• Secret values are never read back: no tool can return them, to the agent or to you.

How isolation works »

07What it costs

Driving the platform through an agent costs nothing in itself. Administration calls (create a function, list your databases, read your metrics, change a variable) go through the platform API and are not billed.

What is billed is execution. An invocation triggered by an agent is counted exactly like any other, and is subject to the same credit gate: an empty balance refuses it at the edge, before your code even starts. An agent therefore cannot drain your balance behind your back.

Full billing details »

08Frequently asked questions