Connect an MCP client

The hosted Quave ONE MCP endpoint is:

https://mcp.quave.cloud/

It uses remote Streamable HTTP; it does not run a local STDIO server or execute commands on your computer.

OAuth (recommended)

Use OAuth when your MCP client supports remote MCP authorization. You do not need to create or paste an MCP key.

1. Add the Quave ONE MCP endpoint in the client.
2. Let the client discover the authorization server and begin its OAuth flow.
3. Sign in to Quave ONE, verify the application and callback origin, then choose By permissions or By tools on the consent screen.
4. Approve the minimum access required. Read-only is the default starting selection when the client requested only read access, but verified clients can present the full capability set for an explicit step-up. The client receives its own scoped token and connects.

Quave ONE uses OAuth 2.1 with PKCE. Dynamic Client Registration is accepted automatically for local HTTP loopback callbacks. Remote and custom-scheme callbacks must match a trusted profile exactly. A client outside those paths needs a Quave ONE administrator to register its exact callback profile or provide a static client ID before it can connect.

Which clients connect automatically?

Leave an optional Client ID field empty for these supported paths:

Client callback type	Automatic?	Requirement
Local desktop or CLI	Yes	Every registered callback must be HTTP loopback: localhost, 127.0.0.1, or [::1]. Any port is accepted and PKCE is required. This includes Claude Code.
Claude web connector	Yes	Its complete callback set must be exactly https://claude.ai/api/mcp/auth_callback (with or without its trailing slash variant).
Cursor Desktop	Yes	Its complete documented callback profile is accepted, including the supported cursor://anysphere.cursor-mcp/oauth/... callbacks and its documented Streamable HTTP callback set.

The following are intentionally not registered automatically:

• any remote HTTPS callback not listed above;
• any custom-scheme callback other than the registered Cursor profiles;
• an HTTP callback that is not loopback; or
• a mixed callback set, such as one loopback URI plus one remote URI.

For a blocked client, do not use an MCP key as an OAuth workaround. Send Quave ONE support the client's complete redirect_uris set from its DCR error or registration metadata — not only the callback currently shown in the browser. Quave ONE can either register that exact set as a trusted DCR profile or create a static public client and return its Client ID. A client ID is then necessary only for that exception path.

Claude Code with OAuth

Claude Code is a local HTTP MCP client. Its OAuth callback is a loopback URL and can select any available local port. Quave ONE automatically accepts the local loopback callback through Dynamic Client Registration and requires PKCE. You do not need a Client ID, client secret, MCP key, or support request.

Configure Claude Code:

claude mcp add --transport http --scope user \
  quave-one https://mcp.quave.cloud/

In Claude Code, run /mcp, choose Authenticate for quave-one, and complete the Quave ONE sign-in and consent flow in the browser. Use claude mcp get quave-one to confirm the server configuration. For a shared project configuration, replace --scope user with --scope project.

note

This automatic path is only for local HTTP loopback callbacks. A remote web client or a custom-scheme callback still needs a trusted Dynamic Client Registration profile or a support-provided static client ID.

Consent choices

The OAuth consent screen always creates one server-enforced authorization mode:

• By permissions grants Quave ONE capability scopes, such as read-only, deploy, configuration, secret-reading, dangerous operations, MCP-key management, or admin operations.
• By tools grants only the selected MCP tools. The selector is grouped and searchable like the MCP-key tool selector. New tools are not added automatically.

The default selection matches the client’s request. Verified clients may show a larger available ceiling so you can explicitly approve more access during the connection. Existing connected apps can be reduced or revoked; to add permissions, add tools, or switch modes, reconnect the client and approve a new OAuth request.

Manage OAuth access

Open User Menu → MCP → Connected apps to view the app, callback origin, current authorization mode, connection time, and last use. Revoke access there or reduce access inside the current mode. To add permissions, add tools, or switch between By permissions and By tools, reconnect from the client and approve the new consent request.

OAuth capabilities are stable Quave ONE permissions such as quave:read and quave:write:deploy, rather than one OAuth scope per tool. A grant is either permission-based or tool-based; Quave ONE does not mix those modes for new connections.

API and MCP OAuth are separate

An OAuth token issued for the MCP resource can only open an MCP session. A Public API OAuth token cannot be used for MCP. An integration that needs both must obtain separate grants; both appear in Connected apps.

MCP keys

Use a key for a legacy integration or a client that cannot use OAuth. Create a different key for each device or client so you can identify, rotate, disable, or revoke it independently.

1. In Quave ONE, open User Menu → MCP and select Create MCP Key.
2. Give it a recognizable name.
3. Choose By permissions or By tools, then grant only what that client needs. See Security and authorization.
4. Copy the key immediately. Quave ONE does not show the plaintext key again.
5. Configure the key as the raw value of the Authorization header — do not prefix it with Bearer.

Generic configuration

URL: https://mcp.quave.cloud/
Authorization: YOUR_MCP_KEY

Codex (CLI and IDE extension) with an MCP key

Codex can use the hosted Quave ONE MCP server directly. Create an MCP key as described above, then add this entry to your global Codex configuration file:

~/.codex/config.toml

For one project only, use .codex/config.toml at that project's root instead.

[mcp_servers.quave-one]
url = "https://mcp.quave.cloud/"
http_headers = { authorization = "YOUR_MCP_KEY" }

Restart Codex (or its IDE extension), then verify the configuration:

codex mcp list

note

Use the raw MCP key in http_headers; do not add Bearer. Codex's --bearer-token-env-var option is for Bearer tokens and is not the MCP-key configuration path.

Cursor with an MCP key

{
  "mcpServers": {
    "quave-one": {
      "url": "https://mcp.quave.cloud/",
      "headers": {
        "authorization": "YOUR_MCP_KEY"
      }
    }
  }
}

Claude Code with an MCP key

claude mcp add --transport http --scope user quave-one https://mcp.quave.cloud/ \
  --header "authorization: YOUR_MCP_KEY"

For a project-only Claude Code configuration, use --scope project instead of --scope user. Other clients use the same endpoint and raw Authorization header convention.

note

MCP keys are for MCP only. They cannot call the Quave ONE Public API directly; use an API token or Public API OAuth for that.

OAuth-only account policy

An account administrator can enable Require OAuth for automated API and MCP access. When enabled, legacy MCP keys and legacy API tokens are rejected for that account’s resources, while dashboard access remains unchanged. Existing keys and tokens are not deleted; disabling the policy restores their legacy use. OAuth-only does not require MFA from the acting administrator.