# MCP server

> https://docs.errora.org/en/products/mcp

Errora exposes a **Model Context Protocol** endpoint so AI agents can triage your issues:
read a stack trace, search logs, resolve a bug — scoped to what the token's owner is allowed
to see.

```text
POST https://<your-errora-host>/mcp
Authorization: Bearer errora_pat_…
```

JSON-RPC 2.0, with the standard `initialize`, `tools/list` and `tools/call` methods.

## 1. Mint a personal access token

**Profile → Personal access tokens → New token**. Copy it once — only its prefix is stored
for display. See [Personal access tokens](/en/account/tokens).

## 2. Point your client at it

Claude Code / Claude Desktop (`.mcp.json` or the app's MCP settings):

```json
{
  "mcpServers": {
    "errora": {
      "type": "http",
      "url": "https://errora.example.com/mcp",
      "headers": { "Authorization": "Bearer errora_pat_…" }
    }
  }
}
```

Cursor and other MCP clients take the same URL + header pair.

## Tools

| Tool | What it does |
| --- | --- |
| `whoami` | The authenticated user and their organizations |
| `list_projects` | Projects the user can access, optionally filtered by `organization_slug` |
| `list_issues` | Issues for a project — Sentry-style `query`, `status`, `environment`, `user`, `sort` (`times_seen` = occurrences), `limit` |
| `get_issue` | One issue: the latest event (exception + stack frames) for an exception issue, the timing detail for a performance one |
| `list_performance_issues` | Slow routes and background jobs with p50/p75/p95/p99, throughput and failure rate |
| `get_performance_issue` | Where one transaction's time goes: per-op breakdown (queries, cache, HTTP, job execution), slowest spans, recent samples |
| `update_issue_status` | Resolve / ignore / unresolve (needs issue-write permission) |
| `search_logs` | Structured log search: `query`, `level`, `user`, `stats_period`, `limit` |
| `get_wallet_balance` | Balance, credit limit and current-period usage cost per service |

Every tool is scoped to the token owner's memberships — an agent can never see a project its
user can't.

`user` accepts a scoped selector (`id:42`, `email:ada@example.com`, `username:ada`, `ip:10.0.0.9`)
or a bare value matching any of those, the same syntax the dashboard's user filter puts in the URL.

## Example session

```jsonc
// tools/call
{"jsonrpc":"2.0","id":2,"method":"tools/call",
 "params":{"name":"list_issues",
           "arguments":{"project":"checkout","query":"timeout","status":"unresolved","limit":10}}}
```

A useful prompt once it is connected:

> Look at the top unresolved issues in the `checkout` project, read the stack trace of the
> worst one, find the matching code in this repository, and propose a fix.

## Watching your own MCP traffic

Spans emitted by MCP servers (`mcp.*`) feed the **MCP Server** dashboard in
[AI monitoring](/en/products/insights) — traffic, clients, methods, most-used tools.

## Security

- A PAT carries **its owner's permissions**. Give agents a token from an account with the
  access you actually want them to have.
- Tokens are stored hashed; revoke one from the same screen at any time.
- The endpoint is deliberately a plain synchronous, token-authenticated surface — no
  cookies, no session, no CSRF path.

## Troubleshooting

| Symptom | Cause / fix |
| --- | --- |
| `401` | Token typo, revoked token, or the `Bearer ` prefix is missing |
| Client sees no tools | It didn't complete `initialize`, or it expects SSE — Errora speaks plain HTTP JSON-RPC |
| `403` on `update_issue_status` | The token owner lacks `issue:write` on that project |
| Empty `list_projects` | The user is a member of an organization but not of any project with `project:read` |