Authdog's MCP server is the control plane for the account you sign in with. A coding agent can list tenants, create projects, set redirect URIs, and inspect users. It is not the MCP server your product exposes to its own agents. That server is [Build an MCP server](/docs/ai/mcp-development/build-server).

The endpoint is `https://api.authdog.com/mcp` (streamable HTTP).

## Connect a client

The CLI writes the URL into the client config. The client signs in when the server answers `401` with `WWW-Authenticate`. The CLI does not put a bearer token in that file.

```bash
authdog mcp install --client cursor
authdog mcp list
authdog doctor --mcp
```

| Client | Flag |
| --- | --- |
| Cursor | `--client cursor` (this is the default) |
| Claude Code | `--client claude` |
| VS Code | `--client vscode` |
| Codex | `--client codex` |
| Every installed client | `--all` |

`authdog mcp uninstall` removes the Authdog entry and leaves your other MCP servers in place. `authdog doctor --mcp` checks that the protected-resource metadata is reachable.

Sign in with the Authdog account that should own the changes. The tools run as that person.

## How the agent should behave

The server instructions tell the agent to show options and wait. A few rules are worth knowing before you let it click through:

- It lists tenants, then projects, then fetches the project. It should not pick one for you, and it should not guess the project type from the name. Ask it whether you want web (OAuth app), m2m (machine-to-machine), or mcp (MCP server).
- Mutations send `confirm=true` only after you confirm. Deletes need the exact name you expect.
- After it creates a project, it should call `get_sdk_config` for the issuer, the client id, and the public key. The public key (`pk_...`) selects the identity host. It is not the OIDC `client_id`.
- `create_client` creates a public PKCE client. It does not hand back a client secret. Redirect URIs come from you, not from a guess.

Tools cover tenants, projects, environments, OIDC clients, redirect URIs, and end users. Two prompts are built in: `provision_web_app` for a web app wire-up, and `explore_tenant` to walk tenants and projects.

## What this server is not

| Job | Where |
| --- | --- |
| Your product's MCP tools | [Build an MCP server](/docs/ai/mcp-development/build-server) |
| A user signing an MCP client into your server | [Connect an MCP client](/docs/ai/mcp-development/connect-client) |
| An agent calling your API with its own credential | [Agent frameworks](/docs/agent-frameworks) |
| The console page for an MCP project | [MCP servers](/docs/console/mcp) |

## Related

| Read | To learn how to |
| --- | --- |
| [Skills](/docs/ai/skills) | Give the agent the docs before it calls tools |
| [MCP servers](/docs/console/mcp) | Register the MCP project your users call |
| [Machine identity](/docs/machine-identity) | Issue a credential for an unattended workload |