Skip to main content

MCP reference and troubleshooting

Manage MCP keys​

Open User Menu → MCP to view each key’s name, authorization mode, grants, security level, session duration, last use, and enabled status.

  • Edit: change grants, authorization mode, security level, or session duration.
  • Regenerate: creates a new key value and invalidates the old one immediately. Update every client that used the old key.
  • Disable: blocks the key at the server while retaining it for later re-enable or investigation.
  • Delete: permanently removes the key.

Use Connected apps on the same MCP area to inspect or revoke OAuth grants.

Troubleshooting​

OAuth client cannot connect​

Confirm the configured endpoint is https://mcp.quave.cloud/. If the client supports Dynamic Client Registration and has an optional Client ID field, leave that field empty for supported clients such as the documented Claude and Cursor MCP flows. Quave ONE should register the client during the OAuth flow.

Dynamic Client Registration requires the client’s complete callback URI set to match a trusted Quave ONE callback profile exactly. If a supported client says registration failed or asks for a client ID, collect the client’s registration reference or callback URI set and ask Quave ONE support to update the trusted profile. Use a static client ID only for custom clients or as a support-guided fallback.

Invalid or disabled MCP key​

Check that the raw key is in the Authorization header, with no Bearer prefix. Then verify the key is enabled and has not been regenerated. Create a separate replacement key instead of sharing another client’s key.

“MCP keys cannot be used directly”​

This is expected when a key is sent to the Public API. MCP keys are accepted by the MCP server only. Use a Public API token or Public API OAuth for direct API automation.

Insufficient scope or tool not selected​

Reconnect and request the required OAuth capability, or edit the MCP key’s permissions/allowlist. A client cannot expand its own access without a new server-authorized grant.

No confirmation prompt​

Security level and session duration are client features. The operation can still be denied by Quave ONE if its authorization grant, key, role, or environment permission is insufficient.

FAQ​

Do OAuth and MCP keys coexist? Yes. OAuth is recommended, and keys remain supported unless the account enables OAuth-only automated access.

Can I use one OAuth token for MCP and the Public API? No. OAuth tokens are bound to one protected resource. Obtain separate MCP and Public API grants.

Can I use MCP keys in CI/CD? Use Public API tokens or Public API OAuth for non-interactive automation. MCP keys are intended for MCP clients.

Are keys encrypted? Yes. Quave ONE encrypts MCP keys at rest. The plaintext value is shown only when it is created or regenerated.

Can a modified client bypass authorization? No. It may bypass its own confirmation UI, but Quave ONE still enforces authorization and platform permissions on every request.

Further reading​

Protocol compatibility​

Quave ONE MCP uses remote Streamable HTTP and is horizontally stateless: each request is independently authenticated and authorized by Quave ONE. The same endpoint speaks both MCP protocol 2026-07-28 (modern _meta clients such as Cursor) and the 2025 Streamable HTTP initialize flow (legacy clients, including the in-dashboard agent). Existing MCP clients that use either handshake remain supported.

Tool catalogs include a human-readable title plus standard read-only, destructive, and idempotency safety hints. Compatible clients, including Claude, can use those annotations to separate safe retry/read-only operations from write/delete operations. Quave ONE product groups remain authorization-UI metadata because MCP has no standard product-category field for clients to render. These hints improve compatible client UX, but do not grant access: Quave ONE validates the OAuth grant or MCP key, account and environment access, and operation-specific policy on every call.

Quave ONE returns durable deployment and JobRun IDs. Use get-app-env-status and the JobRun tools to monitor them. MCP Tasks are not advertised yet, so clients must keep using these supported polling tools.

Dynamic Client Registration remains available only for exact trusted callback profiles. Client ID Metadata Documents are not supported yet; clients should use OAuth discovery with trusted DCR or an administrator-provided static client ID. OAuth authorization responses include the authorization-server issuer so compatible clients can bind the response to the server they discovered.