MCP for AI assistants

MCP, the Model Context Protocol, is the standard way AI assistants call outside tools. Reploya runs an MCP server: the assistant lists its tools, calls them while it answers you, and gets the same data the dashboard shows. Nothing it can call approves, releases or changes anything.

Two ways in: sign in with your own Reploya account (the assistant then reads as you, with your role), or an API key sent as Authorization: Bearer. Owners and admins create API keys on the API access page.

https://app.reploya.com/api/mcp

Paste it exactly as shown, without a trailing slash. The API access page in the dashboard shows it with a copy button.

"Published client identity" means the client proves who it is with a document on its own domain, and the consent page names that domain. A self registered client names itself, so Reploya marks its name as unverified.

1. In Claude (web or Desktop), open Settings, then Connectors, and choose Add custom connector.
2. Name it Reploya and paste the server URL. Leave the OAuth fields empty.
3. Choose Connect, sign in to Reploya, and choose Allow on the consent page.

On Team and Enterprise plans an owner adds the connector first; each member then connects with their own account.

With developer mode on, add a connector with the server URL and authentication OAuth. ChatGPT opens Reploya's sign in; choose Allow.

Add the server to .vscode/mcp.json (or your user configuration). VS Code asks you to sign in on first use.

{
  "servers": {
    "reploya": {
      "type": "http",
      "url": "https://app.reploya.com/api/mcp"
    }
  }
}

Or with an API key:

{
  "servers": {
    "reploya": {
      "type": "http",
      "url": "https://app.reploya.com/api/mcp",
      "headers": {
        "Authorization": "Bearer rpk_…"
      }
    }
  }
}

claude mcp add --transport http reploya https://app.reploya.com/api/mcp
# then, inside Claude Code:
/mcp

In /mcp, choose Reploya and authenticate. Or with an API key:

claude mcp add --transport http reploya https://app.reploya.com/api/mcp \
  --header "Authorization: Bearer $REPLOYA_API_KEY"

Add the server to ~/.cursor/mcp.json; Cursor registers itself and opens Reploya's sign in.

{
  "mcpServers": {
    "reploya": {
      "url": "https://app.reploya.com/api/mcp"
    }
  }
}

Or with an API key:

{
  "mcpServers": {
    "reploya": {
      "url": "https://app.reploya.com/api/mcp",
      "headers": {
        "Authorization": "Bearer ${env:REPLOYA_API_KEY}"
      }
    }
  }
}

In settings.json, add the server with httpUrl. Without headers, Gemini CLI registers itself and signs in through /mcp auth reploya; with an API key:

{
  "mcpServers": {
    "reploya": {
      "httpUrl": "https://app.reploya.com/api/mcp",
      "headers": {
        "Authorization": "Bearer $REPLOYA_API_KEY"
      }
    }
  }
}

1. Add an AI Agent with the MCP Client Tool.
2. Endpoint: the server URL; transport: HTTP Streamable.
3. Authentication: Bearer Auth with an API key, which suits a workflow that runs unattended. Or the MCP OAuth2 credential with dynamic client registration, which signs in as you.

1. In your agent, add a tool, choose Model Context Protocol, and paste the server URL.
2. Authentication: API key, header name Authorization, and as the value Bearer rpk_…. Every user of the agent then reads with that organization key.
3. Or OAuth 2.0 with Dynamic discovery, so each user signs in to Reploya with their own account.

The OpenAI Responses API and the xAI Grok API call remote MCP servers on your behalf. They have no sign in flow, so send an API key in the tool's headers:

{
  "model": "<model>",
  "tools": [
    {
      "type": "mcp",
      "server_label": "reploya",
      "server_url": "https://app.reploya.com/api/mcp",
      "headers": {
        "Authorization": "Bearer <your API key>"
      },
      "require_approval": "never"
    }
  ],
  "input": "Which apps wait for approval?"
}

For Grok, set the same header in the remote MCP tool's authorization or headers field.

Every tool is read only. Answers carry the same fields as the API, never a person's name or email, a Microsoft tenant id, a group id or a token. The policy list appears only where Policy Manager is available.

• The consent page names the assistant, the site it comes from, your organization and your role. Only choose Allow if you started the connection yourself.
• Every member can connect, at most 10 assistants each. An assistant reads as you: if your role changes or you leave the organization, it changes or stops with you.
• Sign in lasts while you use it: an unused connection ends after 30 days. A client whose registration expired reconnects by itself, or after you choose Reconnect.

In the dashboard, open External access, then API access. The AI assistants card lists your connections; Disconnect ends one at once. Owners and admins see everyone's connections and can disconnect any. Every connect and disconnect shows in the activity log.

• 60 requests per minute per connection or API key; then 429 with Retry-After.
• Without a valid sign in or key the server answers 401 and tells the client where to sign in.
• An inactive subscription, or a plan without MCP, answers 403.

The server answers on the app host only. Use the URL above, not the website address.