The NoClick MCP server
Let Claude, ChatGPT, Cursor or any MCP client build on the platform, signed in with OAuth or with a platform key.
The platform is also an MCP server. Connect Claude, ChatGPT, Cursor, Codex or any other MCP client to it, and the agent in that client can create agents and resources, connect accounts, deploy apps, buy what has a price and read what happened, just as your code would. Every call it makes meets the same scopes, spend caps and approval rules as your code's.
The server is at:
POST https://mcp.noclick.comIt speaks Streamable HTTP. A client either signs in with OAuth, where you choose on NoClick what the connection may do, or sends a platform key as Authorization: Bearer nk_live_.... Its tools are a few task-shaped ones (search and fetch for docs, skills and objects, resources_save, apps_deploy, quote then purchase, wait for long work) plus api_describe and api_call for any other API operation. Creating keys, changing policy and reading secrets' values stay with a person.
Claude and ChatGPT
Add https://mcp.noclick.com as a custom connector. The first time the client uses it, NoClick asks you to sign in and choose what the connection may do: build, deploy, spend (with a monthly cap, and an amount under which a purchase needs no approval) and delete. Reading is always allowed. Each connection is listed under Connected apps beside your API keys in the developer console, where you can revoke it.
Claude Code
claude mcp add --transport http noclick https://mcp.noclick.comThen run /mcp in Claude Code to sign in. To use a platform key instead:
claude mcp add --transport http noclick https://mcp.noclick.com \
--header "Authorization: Bearer $NOCLICK_API_KEY"Cursor
Add this to .cursor/mcp.json, or leave out headers to sign in with OAuth:
{
"mcpServers": {
"noclick": {
"url": "https://mcp.noclick.com",
"headers": { "Authorization": "Bearer ${env:NOCLICK_API_KEY}" }
}
}
}Other clients
Any client that supports remote MCP servers over HTTP works the same way: the URL above, and either its OAuth sign-in or Authorization: Bearer with your key.
The tools
Every tool tells the client what it changes (MCP's read-only, destructive, idempotent and open-world hints), so a client can run reads without asking and ask a person before the rest. A write creates or changes your account's own things; a sensitive tool sends, spends, deletes or puts something live, and clients should ask before each call.
| Tool | What it does | Kind |
|---|---|---|
search | Finds docs, skills, examples, API operations and your account's objects | Read |
fetch | Reads one doc page, skill or object in full | Read |
account_status | Balance, spend, approvals waiting and what's failing | Read |
logs | Bounded logs of a deployment, app, agent conversation, call or trigger | Read |
wait | Waits up to 40 seconds on long work and returns its result | Read |
approvals | Purchases and deletions waiting on a person; it never approves | Read |
quote | Prices a phone number, domain or machine | Read |
api_describe | Describes any API operation | Read |
agents_save | Creates an agent, or updates one by name (an update replaces the fields it sets) | Write |
agents_test | Runs a turn of an agent against a simulated world: nothing real is sent, bought or changed | Write |
workflows_save | Has NoClick's builder build a workflow from a description, or change one by name, and answers what it asks | Write |
resources_save | Creates or updates a database, bucket, volume, queue, channel, inbox, webhook, trigger and more | Write |
secrets_request | Creates a secret by name and returns the NoClick page where a person types its values | Write |
repos_push | Commits files to a repo (adding, replacing or deleting them), or returns a push remote | Write |
connections_connect | Returns the link a person opens to connect an account; it can email the link to them | Sensitive when it emails |
apps_deploy | Deploys a preview of a branch, or production, which replaces what's live | Sensitive for production |
agents_message | Gives an agent a live turn, in which its own tools act for real | Sensitive |
purchase | Buys what quote priced, once a person agreed | Sensitive |
delete | Previews what a deletion does, then deletes, cancels or revokes | Sensitive |
api_call | Calls any other API operation by name; purchases and deletions are refused there | Sensitive |
Errors say what went wrong and what to do next, and long work returns an operation to wait on. Each connection is rate limited like an API key.
Other URLs on the server
| URL | What it serves |
|---|---|
https://mcp.noclick.com | the task tools above |
https://mcp.noclick.com/readonly | the tools that read, api_describe, and api_call limited to reads |
https://mcp.noclick.com/code | the task tools plus query and run, which run a short Python program against the SDK in a sandbox |
https://mcp.noclick.com/directory | the task tools without api_describe, api_call, quote and purchase |
https://mcp.noclick.com/x/{area} | one tool per API operation of one area, such as agents or phone |
Each of them also acts for one of your users: https://mcp.noclick.com/u/{user_id}, https://mcp.noclick.com/u/{user_id}/readonly and so on make every call as that user, for clients that can't send the NoClick-User header.
The server's playbooks are skills: listed in its instructions, read with fetch (skill:<name>), offered as prompts, and indexed at https://mcp.noclick.com/.well-known/skills/index.json for agents that discover skills by URL.
Give your hosted agents the same tools
"noclick" in a hosted agent's tools gives it the same server's core tools (search, fetch, api_describe, api_call, quote, buy and delete), acting as each turn's key, under the same rules: a deletion to the trash happens at once, restorable for 30 days, a purchase or a deletion that can't be undone waits for your account's owner, and a secret's value never comes from its conversation. noclick.Platform.only("read") or noclick.Platform.only("domains") narrows it. See Give it NoClick itself.
Keep the agent's key narrow
The agent can do whatever its key can. Give it a key of its own with only the scopes it needs, and a monthly spend cap (see API keys and scopes). Your policy applies to it like any other caller, so tools you've forbidden stay forbidden and approvals still go to a person.
MCP servers for your users
This server is for you and your coding agents. If you run an MCP server of your own for your users, a toolkit gives you NoClick's tools to serve from it: definitions("mcp") for the tool list and call() to run each one as the right user.
Support
Email support@noclick.com for help with the server or a connection. The privacy policy says what NoClick keeps and for how long, and the developer terms, with the acceptable use policy, cover using it. To end a connection, revoke it under Connected apps in the developer console.