# How to connect your AI coding agent to Ownkube with MCP

> Add Ownkube's hosted MCP server to Claude Code, Cursor, Codex, Windsurf, Zed, or Claude Desktop, sign in once, and deploy without leaving your editor.

- **Published:** 2026-08-21
- **Author:** Ownkube team
- **Category:** How-To
- **Tags:** mcp, ai-agents, claude-code, cursor, tutorial
- **Canonical URL:** https://ownkube.io/blog/connect-ai-agent-mcp
- **Cover:** https://ownkube.io/blog/connect-ai-agent-mcp.png

---
Ownkube runs a hosted MCP server at `app.ownkube.io/api/mcp`, so a coding agent that speaks the [Model Context Protocol](https://modelcontextprotocol.io/) can deploy your app, read its logs, and manage its database without you switching to a browser tab. This is a walkthrough of adding it to the agents people actually use: Claude Code, Cursor, Codex, Windsurf, Zed, and Claude Desktop.

**TL;DR**

- The Ownkube MCP server lives at `https://app.ownkube.io/api/mcp` and uses OAuth 2.1 with browser sign-in, so there is no API key to paste into a config file.
- Each client adds the server slightly differently: a one-line CLI command for Claude Code, a JSON file for Cursor and Windsurf, a config entry through the `mcp-remote` bridge for Codex, Zed, and Claude Desktop.
- Signing in once opens a browser tab where you pick an organization; the connection is scoped to that org until you change it.
- About 77 tools are exposed: deploying apps, workers, and jobs, reading logs and metrics, managing databases, custom domains, alerts, and billing.
- A few things are deliberately kept out of the agent's reach: live database and cache credentials, password resets, and point-in-time recovery. Those stay in the `okctl` CLI.

## What the MCP server actually does

Adding Ownkube as an MCP server gives your agent the same operations you'd otherwise do by hand in the dashboard: creating a deployment, checking whether it's healthy, tailing its logs, adding a [managed Postgres database](/blog/add-managed-postgres-database) or a [Valkey cache](/blog/add-valkey-redis-cache), setting a CPU or memory limit, linking a [custom domain](/blog/automatic-https-custom-domain), or checking your wallet balance. The agent calls these as structured tools, not a shell wrapped around the dashboard, so it gets back data it can reason over instead of screen text to guess at.

It does not get everything. Reading a database's live connection credentials, resetting a database password, and running point-in-time recovery are excluded on purpose. Those actions stay behind `okctl`, the command-line client, where you're the one typing the command.

## Before you connect

You need an Ownkube account (sign up at `app.ownkube.io`) and a client that supports remote MCP servers over HTTP. There's nothing to install on the Ownkube side: the server is already running, and connecting is a client-side config change plus a browser sign-in.

## Connect Claude Code

[Claude Code](https://docs.claude.com/en/docs/claude-code) has a built-in command for adding a remote MCP server:

```bash
claude mcp add --transport http ownkube https://app.ownkube.io/api/mcp
```

Run `/mcp` inside Claude Code and choose `ownkube` to authenticate. A browser tab opens, you sign in, pick an organization, and control returns to your terminal. From there you can ask it things like "deploy this repo to Ownkube Compute and give me the live URL" or "tail the logs for my api service and tell me why it keeps restarting."

## Connect Cursor

[Cursor](https://docs.cursor.com/) reads its MCP servers from a JSON config file. Add this to `~/.cursor/mcp.json` (or a project-level `.cursor/mcp.json` if you want the connection scoped to one repo):

```json
{
  "mcpServers": {
    "ownkube": {
      "url": "https://app.ownkube.io/api/mcp"
    }
  }
}
```

Open Settings, then MCP, and toggle the `ownkube` server on. Cursor opens a browser tab for the same sign-in and organization pick, then shows the server as connected in Composer.

## Connect Codex, Windsurf, Zed, and Claude Desktop

These four don't speak remote HTTP MCP servers directly. Each bridges to the same endpoint with `mcp-remote`, a small proxy that handles the OAuth browser flow for stdio-based clients. It needs Node and `npx` on your machine, and the first connection opens the same browser sign-in as Claude Code and Cursor.

| Client | Config file | Entry |
|---|---|---|
| Codex | `~/.codex/config.toml` | `[mcp_servers.ownkube]` block running `npx -y mcp-remote https://app.ownkube.io/api/mcp` |
| Windsurf | `~/.codeium/windsurf/mcp_config.json` | `"ownkube": { "serverUrl": "https://app.ownkube.io/api/mcp" }` |
| Zed | `settings.json`, under `context_servers` | custom source running `npx -y mcp-remote https://app.ownkube.io/api/mcp` |
| Claude Desktop | `claude_desktop_config.json` | `"ownkube": { "command": "npx", "args": ["-y", "mcp-remote", "https://app.ownkube.io/api/mcp"] }` |

For example, Codex's `~/.codex/config.toml` looks like this:

```toml
[mcp_servers.ownkube]
command = "npx"
args = ["-y", "mcp-remote", "https://app.ownkube.io/api/mcp"]
```

After saving, restart or refresh the client so it picks up the new server, then trigger a request that needs it. `mcp-remote` opens the browser tab, you sign in and pick an organization, and the tools show up from then on.

## What you can ask it to do

Once connected, the tools group roughly into deployments (create, list, check status, restart, roll back), logs and metrics, databases and caches, clusters and cloud accounts, custom domains, alerts, and billing. In practice that covers requests like:

- "Deploy this repo to Ownkube Compute and give me the live URL."
- "Add a managed Postgres database and wire the connection string into my app."
- "Set a CPU and memory limit on my web service, then show me the projected monthly cost."
- "Roll back my last deploy to the previous healthy revision."
- "Check my wallet balance and top it up if it's under five dollars."

The agent picks a region and creates the deployment on Ownkube Compute, so there's no cloud account or cluster to provision first.

## A note on where the app can run later

Everything above deploys onto Ownkube-managed compute, no AWS account required. If you later want the same app running in your own AWS account instead, that's a separate step, not a rewrite: the deployment, its logs, and its metrics move with it. Our guide on [moving the same app into your own AWS account](/blog/move-app-to-your-own-aws) covers that path in detail.

## FAQ

### Do I need an API key to connect an agent to Ownkube?

No. The MCP server uses OAuth 2.1 with browser sign-in and org-scoped consent. There's no API key to generate or paste; the `x-api-key` path is for the `okctl` CLI only.

### Is it safe to let an agent operate my Ownkube account?

You approve access through a consent screen scoped to one organization, and you can revoke the connection at any time. A handful of sensitive actions, like reading live database credentials or resetting a password, are deliberately excluded from the agent's tool list.

### Which organization does the agent act on?

The one you pick on the consent screen during sign-in. If you belong to more than one, you can pass an organization explicitly per request; otherwise the agent falls back to the one you consented to.

### What happens if the agent's access token expires?

Calls start failing, and the client re-runs the browser sign-in to mint a fresh token the next time it needs the server. You don't need to remove and re-add the connection.

### Can I use this with an editor that isn't in this list?

If the editor or agent supports remote MCP servers over Streamable HTTP, point it at `https://app.ownkube.io/api/mcp` directly. If it only supports local stdio servers, bridge it with `mcp-remote` the same way Codex, Windsurf, Zed, and Claude Desktop do.

## Where Ownkube fits

If you already work through an agent all day, having it deploy, read logs, and manage a database directly is faster than narrating the same steps into a dashboard. The MCP server exposes the real platform, not a scripted demo: the tools it calls are the same ones the dashboard uses, and the actions it can't take are the ones you'd want to type yourself anyway. [Deploy your first app](https://app.ownkube.io/login).