Claude and other MCP clients

ops login --mcp
ops mcp --project rungholt

ops mcp serves the ops tools to an MCP client over stdin and stdout, with the token of this machine. The client sees the same tools the console's assistant has, and each call is checked against the token's role like any other.

Sign in with ops login --mcp first, so the approver sees the token is for an assistant and can give it a narrower role.

Claude Code

Put this in the project's .mcp.json:

{ "mcpServers": { "ops": { "command": "ops", "args": ["mcp", "--project", "rungholt"] } } }

The console's Develop page prints the same block for your project.

--project fills in the project on a tool call that names none. It is a convenience, not a limit: what the client may do is decided by the token. To keep it inside one project, pin the token with ops login --mcp --project rungholt.

Behaviour

• The command prints nothing of its own on stdout, which belongs to the protocol.
• It never prompts. Without a token it says Run ops login --mcp first. on stderr and exits 3.
• There is no tool that opens a shell in a container.