AI CodeOps and MCP, both directions

The Model Context Protocol (MCP) lets an AI agent call tools on another service. AI CodeOps works both ways: your coding assistant can use AI CodeOps through its MCP server, and the agents in your sessions can use the MCP servers you add. MCP support is in beta.

Use AI CodeOps from Claude Code or Cursor

Create a workspace API key under Configure → API Keys, then add the server. In Claude Code:

claude mcp add --transport http aicodeops https://console.aicodeops.dev/mcp   --header "Authorization: Bearer sk-..."

Run /mcp to see it connected. Your assistant can then list your projects, start a session with a task, follow it, list open findings, check whether a pull request may ship, and fetch a change's signed evidence pack. Each tool acts as the key's creator, with that member's role, budget and limits. Setup for Cursor and other clients, and what each tool needs, is in the MCP server guide.

Connect MCP servers to your sessions

AI CodeOps connects to the MCP servers you add, and the agents in your sessions can then call their tools while they plan, write and review a change.

What works

• Remote servers: sessions connect to each enabled remote server when they start, list its tools and offer them to the agents.
• Local servers: you can register a stdio command with environment variables, but sessions don't start it. Sessions run on the platform, not on your machine.
• Transport: remote servers must speak the MCP Streamable HTTP transport (JSON-RPC over POST, answered with JSON or an event stream). The older SSE-only transport isn't supported.
• Authentication: static headers, such as Authorization=Bearer <token>. Servers that need an OAuth sign-in aren't supported yet.

Tools reach the agents as <server>__<tool>, for example github__create_issue. The server part is an ID made from the name you give it: "Docs Search" becomes docs-search.

Set it up

1. Open Configure → MCP Servers and choose Add MCP server. Or go straight there: Open in AI CodeOps.
2. Enter a Name, choose Remote (HTTP/SSE URL) and enter the Server URL.
3. Under Headers, add one KEY=value per line:

``text Authorization=Bearer <your token> ``

1. Choose Save MCP server. It appears under Servers, where you can disable or remove it.

There is no edit form yet: to change a server, remove it and add it again. Adding and removing servers needs the MCP-manage permission, which owners, admins and DevOps admins have by default. The full guide is in MCP servers.

What's stored, and who sees it

Headers for remote servers, and environment variables for local ones, are encrypted at rest with AES-256-GCM. They are never sent back to the browser and are decrypted only when a session connects. Members who can't manage MCP servers see only the server's address origin, not the full URL. Adding, changing, enabling, disabling and removing a server are all recorded in the audit log.

Control which tools agents can call

Every MCP tool call is the mcp.invoke action in the policy engine. A rule matches server/tool, and a tool the policy doesn't allow is never offered to the agents. This rule keeps every delete tool on the github server out of your sessions:

{ "id": "no-repo-deletes", "action": "mcp.invoke", "resource": "github/delete_*", "decision": "deny" }

mcp.invoke rules take allow or deny, not ask, because a tool call can't wait for an approval. With the None trust posture, MCP tools are denied unless a rule allows them. You can narrow further per agent: a custom agent on Configure → Agents has an MCP tools allowed field. See agents and workflows.

Limits

• The URL must be public https. Plain http:// addresses, private networks, localhost and .local or .internal names are skipped when a session connects, and the address is checked again on every connection.
• Redirects aren't followed. A server that answers with a redirect is skipped.
• A server that can't be reached is skipped, and the session runs without its tools.
• A session offers at most 32 MCP tools in total, and an agent can make up to 6 rounds of tool calls per step.
• Each call times out after 30 seconds, and long results are shortened.

Getting started

1. Create a free account: AI CodeOps is in open beta and runs in your browser.
2. Add a remote MCP server from Configure → MCP Servers.
3. Run a session in a project. The quickstart walks through it.

AI CodeOps also connects to your Git host, so the same sessions that call your tools open the pull request.