MCP server

Ownkube runs a hosted remote MCP server. Point any MCP-capable client at one URL, sign in once, and your agent can ship deployments, tail activity, and manage environments on your behalf. It uses the same permissions and tenant isolation as your dashboard account, and Ownkube never receives your cloud keys.

MCP (the Model Context Protocol) is an open standard for connecting agents to tools. Because this is a remote server that speaks OAuth, any client with remote-MCP support connects the same way: Claude, other desktop and web assistants, agent frameworks, and your own code via an MCP SDK. The walkthrough below uses Claude as a concrete example; the URL and the flow are identical everywhere else.

The server URL

https://app.ownkube.io/api/mcp

That is the only value you need. Authentication happens in the browser: there is no token or API key to copy, and nothing secret to paste into a config file.

Connect your coding agent

Every client follows the same shape: point it at the server URL, authorize in the browser, pick an organization. The only thing that differs is where you add the server. Pick your client below for the exact step.

Clients that speak HTTP MCP (Claude Code, Cursor, GitHub Copilot, Windsurf) connect to the URL directly. Terminal and desktop clients that speak stdio (Codex, Zed, Claude Desktop) use mcp-remote, a small bridge that connects a local client to the remote endpoint and runs the browser sign in for you. It needs Node and npx on your machine.

Claude Code

1. Install Claude Code

   npm install -g @anthropic-ai/claude-code

2. Add the server

   claude mcp add --transport http ownkube https://app.ownkube.io/api/mcp

   Streamable HTTP is what the --transport http flag targets. On first use Claude Code registers itself and starts the browser sign in automatically.

3. Authenticate

   Run /mcp inside Claude Code and choose ownkube. A browser tab opens for you to sign in and pick an organization, then control returns to your terminal.

Cursor

1. Open the MCP settings

   Download Cursor from cursor.com, then open Settings > MCP.

2. Add the server

   Add it to ~/.cursor/mcp.json (or a project-level .cursor/mcp.json to scope it to one repo):

   ~/.cursor/mcp.json

   {
     "mcpServers": {
       "ownkube": {
         "url": "https://app.ownkube.io/api/mcp"
       }
     }
   }

3. Authenticate

   Toggle the ownkube server on in Settings > MCP. Cursor opens a browser tab to sign in and pick an organization, then shows the server as connected.

GitHub Copilot

1. Enable agent mode

   Install VS Code and the GitHub Copilot extension, then enable agent mode.

2. Add the server

   Add it to the workspace config at .vscode/mcp.json:

   .vscode/mcp.json

   {
     "servers": {
       "ownkube": {
         "type": "http",
         "url": "https://app.ownkube.io/api/mcp"
       }
     }
   }

3. Authenticate

   Open the MCP view and start the ownkube server. VS Code opens a browser tab for you to sign in and choose an organization, then marks the server running. Switch Copilot Chat to Agent mode to use the tools.

Windsurf

1. Open the Cascade MCP settings

   Download Windsurf from codeium.com/windsurf, then open the Cascade MCP settings.

2. Add the server

   ~/.codeium/windsurf/mcp_config.json

   {
     "mcpServers": {
       "ownkube": {
         "serverUrl": "https://app.ownkube.io/api/mcp"
       }
     }
   }

   Windsurf uses serverUrl for a remote MCP server.

3. Authenticate

   Press refresh in the MCP settings. Windsurf opens a browser tab to sign in and pick an organization, then shows ownkube as available.

Codex

1. Install Codex

   npm install -g @openai/codex

2. Add the server

   Codex speaks stdio MCP, so bridge it with mcp-remote:

   ~/.codex/config.toml

   [mcp_servers.ownkube]
   command = "npx"
   args = ["-y", "mcp-remote", "https://app.ownkube.io/api/mcp"]

3. Authenticate

   The first time Codex starts the ownkube server, mcp-remote opens a browser tab for you to sign in and choose an organization. After that it reuses the saved token.

Zed

1. Open settings

   Download Zed from zed.dev, then open settings.json.

2. Add the server

   Zed calls stdio MCP context servers, so bridge it with mcp-remote:

   settings.json

   {
     "context_servers": {
       "ownkube": {
         "source": "custom",
         "command": "npx",
         "args": ["-y", "mcp-remote", "https://app.ownkube.io/api/mcp"]
       }
     }
   }

3. Authenticate

   Save the settings and open the agent panel. mcp-remote opens a browser tab for you to sign in and pick an organization, then Zed lists the ownkube tools.

Claude Desktop

1. Install Claude Desktop

   Download Claude for macOS or Windows from claude.ai/download.

2. Add the server

   Bridge it with mcp-remote:

   claude_desktop_config.json

   {
     "mcpServers": {
       "ownkube": {
         "command": "npx",
         "args": ["-y", "mcp-remote", "https://app.ownkube.io/api/mcp"]
       }
     }
   }

   On paid plans you can also add Ownkube as a custom connector by URL from Settings > Connectors.

3. Authenticate

   Restart Claude Desktop after saving. On first use mcp-remote opens a browser tab for you to sign in and pick an organization, then the ownkube tools appear in the chat.

Once connected, ask for what you need, for example “list my Ownkube deployments” or “roll back the api deployment to the previous revision”. Your agent picks the right tool and calls it.

Tip

Prefer the terminal, scripts, or a coding agent in your editor? The okctl CLI covers the same ground and ships an agent skill. The MCP server and the CLI are two front doors onto the same Ownkube API.

What your agent can do

The MCP server mirrors the Ownkube API surface. Your agent can read and act across the resources you own.

Inspect (read):

Area	What the agent can see
Deployments	Deployments, status, revision history, and live activity
Environments	Environments and their variables
Registries	Connected container registries
Organizations	The organizations your account belongs to, and your user profile

Act (write):

Area	What the agent can do
Deployments	Create and delete deployments, update config, upgrade platform versions, roll back, and promote one deployment’s config onto another
Environments	Create and update environments and set their variables
Jobs	Trigger, cancel, and list job runs

Own cloud (Advanced). If you run in your own AWS account, the same connector also exposes these. On Ownkube-hosted compute they simply don’t apply.

Area	Read	Write
Clusters	Clusters, their status, and lifecycle state	Create, cancel, and destroy clusters
Cloud accounts	Connected AWS accounts and their onboarding state	Connect and reconnect AWS accounts

Write actions change real infrastructure. Tools that create, upgrade, roll back, or destroy are described so the agent confirms with you before running them, but you are in control: treat an agent with this connector the way you would treat a teammate with dashboard access.

Caution

Two things the agent cannot do: it never returns live database connection credentials, and it never resets a database password. Those operations hand back a raw secret, so they stay in the okctl CLI where a human runs them directly. An agent has no tool for either.

Security model

• OAuth, not keys. The connection is authorized with OAuth in your browser. There is no long-lived key to leak, and you can revoke the connector from Claude at any time.
• Scoped to your account. The agent sees exactly what your account can see, in the one organization you approved. The same tenant isolation that guards the dashboard guards every tool call.
• Your cloud stays yours. Ownkube never receives your AWS or GCP keys through this server, and the agent cannot read them out. Cloud access is the scoped, least-privilege role you granted during AWS onboarding.
• Auditable. Every action runs through the same API as the dashboard and CLI, so writes are recorded the same way.

Multiple organizations

The connection is pinned to the organization you picked at approval time. To act on a different organization, add the connector a second time and choose the other organization when prompted, or remove and re-add it. Read-only questions about which organizations you belong to work regardless of the pinned one.

---

Note

Don’t see a feature you need? Email support@ownkube.io. Ownkube is shaped by the teams using it and we ship what our users ask for.