MCPReviewed 11 October 2026

MCP Setup

MCP lets a supported client read your Claron projects, issues, screenshots, and captured diagnostic evidence. Use it to investigate a report without copying each evidence panel by hand.

Before you start

An eligible project role and either a read-only MCP key or supported OAuth connection.

What you get

Your client can read existing reports and evidence with read-only access.

Connect a read-only MCP client

INTERACTIVE EXAMPLE

Switch client configurations and preview a successful read.

StorefrontConnect a read-only MCP client

Sandbox

Cursor: ~/.cursor/mcp.json

json

{
  "mcpServers": {
    "claron": {
      "url": "https://api.claron.dev/api/v1/mcp",
      "headers": { "Authorization": "Bearer ${env:CLARON_API_KEY}" }
    }
  }
}

Connection check

mcp:read · eligible project role

MCP endpoint

This preview does not authorize a client. Complete the real connection in Developer & API.

Try the controls · sample data · changes stay in this example

Access and read-only limits

Use a Claron account with an eligible effective role: project owner, developer, or tester. Workspace owner, admin, and manager authority applies only where it gives qualifying project access. A client or guest cannot use MCP for that project; finance or observer membership alone is insufficient.

Tools read existing data. They do not mark issues read, start investigations, create reports, capture screenshots, apply patches, or change statuses. Project visibility and current plan restrictions still apply.

Backend tools return correlation references and availability, not decrypted server evidence. Use an authorized device in Claron to unlock backend evidence.

Choose authentication and copy the endpoint

Open Settings → Developer & API → MCP setup
Copy the deployed MCP endpoint. The hosted Claron endpoint is https://api.claron.dev/api/v1/mcp; use the URL shown in settings if your deployment differs.
For a coding client, create an API key using the Read-only MCP preset (mcp:read)
Set CLARON_API_KEY in the environment that launches the client, keeping the key out of committed configuration.
For a hosted connector that supports remote HTTP MCP and OAuth, add the copied endpoint, select OAuth with automatic client registration, then sign in to Claron and approve the read-only consent request
Do not select unauthenticated access as a workaround.
Enable the server or connector in the client and restart or refresh its connection
Available connector controls depend on the client's account and organization settings.

Coding-client configuration

Settings supplies copyable configurations for Cursor, Claude Code, and Codex. These configurations reference an environment variable instead of storing the key in the file.

EXPLORER

Cursor: ~/.cursor/mcp.json×

json

1{
2  "mcpServers": {
3    "claron": {
4      "url": "https://api.claron.dev/api/v1/mcp",
5      "headers": { "Authorization": "Bearer ${env:CLARON_API_KEY}" }
6    }
7  }
8}

Cursor: ~/.cursor/mcp.jsonLn 8, Col 1JSONUTF-8

EXPLORER

Claude Code: .mcp.json×

json

1{
2  "mcpServers": {
3    "claron": {
4      "type": "http",
5      "url": "https://api.claron.dev/api/v1/mcp",
6      "headers": { "Authorization": "Bearer ${CLARON_API_KEY}" }
7    }
8  }
9}

Claude Code: .mcp.jsonLn 9, Col 1JSONUTF-8

EXPLORER

Codex: ~/.codex/config.toml×

toml

1[mcp_servers.claron]
2url = "https://api.claron.dev/api/v1/mcp"
3bearer_token_env_var = "CLARON_API_KEY"

Codex: ~/.codex/config.tomlLn 3, Col 1TOMLUTF-8

Test the connection

Ask the client to list your Claron projects
Confirm that an expected eligible project is returned.
Ask it to list issues for that project and read one issue's evidence
Use a real issue UUID from Claron.
Confirm a known captured console entry or screenshot
If an evidence section is unavailable, verify it in Claron rather than treating absence as a clean result.

Tools	Use
list_projects, list_issues, get_issue	Find a project and inspect a report.
get_issue_evidence	Read selected console, network, environment, element, session, and backend-reference sections in one bounded response.
get_screenshot	Read a saved before/after, element/full-page screenshot. Missing variants are reported explicitly.
get_console_logs, get_network_requests, get_network_request	Inspect recorded diagnostics. Request IDs must come from the same issue's request index.
get_session_context, get_environment, get_element_context	Read saved activity, browser/release context, and element details.
get_backend_evidence_references	Read exact correlation references and encrypted-evidence availability.

Authentication and missing evidence

For a 401, check that the key is active, unexpired, and available in the client's launching environment; reconnect an expired OAuth connection. SDK credentials and extension device tokens are not MCP credentials.

For a 403 or a missing project, check mcp:read and the account's effective role on that project. A successful sign-in does not grant a new project role. Do not add wildcard permissions just to bypass an access failure.

Collection tools normally use offset and limit (default 50, maximum 200); list_issues uses page-based pagination (maximum 100). Time filters use UTC epoch milliseconds. Check status and truncated on each response; smaller pages can recover entries shortened by size limits. Screenshots above 8 MiB return too_large.

The endpoint accepts HTTP MCP without a query string and does not provide a stdio server. An application Origin must be allowed by the deployed server. Native clients can omit Origin; arbitrary web origins are not authorized.

Disconnect and revoke access

Remove the connector in its client and revoke its key in Settings → Developer & API if it used an API key. Removing a local config alone does not invalidate the key.

Workspace owners/admins can review and revoke a connection under Developer & API → MCP OAuth access. Check the reported client and redirect host before confirming. Revocation invalidates the connection's access and refresh tokens.

A user's OAuth consent is account-wide. Revoking that member's connection from a workspace disconnects the client from all Claron data that account could access, including other workspaces. Change membership or project roles separately to prevent future authorization.