Connect an MCP client

Tabbify exposes selected platform operations through a Model Context Protocol (MCP) server. MCP coverage is partial and can differ from the web console, REST API, and CLI. The tool list returned by the server is the authority for the current deployment and session.

It's one endpoint, served by the node alongside the REST API:

https://api.tabbify.io/mcp

Two ways to authenticate

• OAuth — recommended for interactive clients. The node exposes a full OAuth 2.1 surface (/.well-known/oauth-protected-resource → /authorize → /token, with dynamic client registration), so your client discovers it automatically and opens a browser consent screen. Nothing to paste. Use this for Claude.ai, Claude Desktop, and Claude Code.
• Bearer token — for headless / CI clients. Mint a token and send it as Authorization: Bearer <token>. Use this for the OpenAI Responses API and any client that can't run the interactive flow.

Mint a token under MCP → Get a token in the console (pick a network → Get MCP token → Copy). It's shown once and is valid for a year; revoke it any time from Deploy tokens. The console also shows a ready-to-paste config with the token already filled in.

Claude

Claude.ai and Claude Desktop (OAuth)

1. Settings → Connectors → Add custom connector.
2. Paste the remote MCP server URL: https://api.tabbify.io/mcp.
3. Leave Advanced settings empty — Tabbify supports dynamic client registration — then click Add, Connect, and sign in. No token to paste.

Claude Code (OAuth)

Add the server with no header, then authenticate in the browser:

claude mcp add --transport http tabbify https://api.tabbify.io/mcp
# then, inside Claude Code:
/mcp

Claude Code (Bearer token — for CI / no browser)

Add it with the token as a header, or drop the JSON into your project's .mcp.json:

claude mcp add --transport http tabbify https://api.tabbify.io/mcp \
  --header "Authorization: Bearer <token>"

{
  "mcpServers": {
    "tabbify": {
      "type": "http",
      "url": "https://api.tabbify.io/mcp",
      "headers": { "Authorization": "Bearer <token>" }
    }
  }
}

Use either OAuth or a Bearer header — not both. If you set the header and the token is wrong, Claude Code fails the connection instead of falling back to OAuth.

OpenAI

Responses API (Bearer token)

Pass Tabbify as a remote MCP tool. The authorization field is a string that OpenAI forwards verbatim as the Authorization header, so include the Bearer prefix:

curl https://api.openai.com/v1/responses \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-5.5",
    "tools": [
      {
        "type": "mcp",
        "server_label": "tabbify",
        "server_url": "https://api.tabbify.io/mcp",
        "authorization": "Bearer <token>",
        "require_approval": "always"
      }
    ],
    "input": "List my Tabbify apps"
  }'

from openai import OpenAI

client = OpenAI()  # reads OPENAI_API_KEY

resp = client.responses.create(
    model="gpt-5.5",
    tools=[
        {
            "type": "mcp",
            "server_label": "tabbify",
            "server_url": "https://api.tabbify.io/mcp",
            "authorization": "Bearer <token>",
            "require_approval": "always",
            # "allowed_tools": ["list_apps", "deploy_pipeline"],  # optional allow-list
        }
    ],
    input="List my Tabbify apps",
)
print(resp.output_text)

Two things to know:

• OpenAI does not store the authorization value (it keeps only the schema and domain of server_url), so you resend authorization on every call.
• require_approval is a client-side confirmation policy; it does not expand the Tabbify credential's scope. Use allowed_tools to restrict which discovered tools the model may call.

ChatGPT (OAuth, beta)

Custom MCP connectors in the ChatGPT app are developer-mode beta (Plus / Pro / Business / Enterprise / Edu, web). Enable Settings → Apps → Advanced → Developer mode, choose Create app, paste https://api.tabbify.io/mcp, and pick OAuth — the ChatGPT UI has no field for a static token, so it connects through the OAuth flow.

Other clients

The same endpoint works anywhere MCP does; only the config key names differ. Each uses the header name exactly Authorization with a Bearer prefix.

For example, Cursor (.cursor/mcp.json):

{
  "mcpServers": {
    "tabbify": {
      "url": "https://api.tabbify.io/mcp",
      "headers": { "Authorization": "Bearer <token>" }
    }
  }
}

Most of these support environment-variable interpolation (e.g. "Bearer ${env:TABBIFY_TOKEN}" in Cursor/Windsurf, or a ${input:…} secret in VS Code) so the token doesn't sit in a committed file.

Discover available tools

After authentication, let the client request the MCP tool list. Depending on the deployed version and account scope, discovered tools may include application reads, selected lifecycle actions, asynchronous deployment, topology reads, or connected-repository operations. Not every console verb is represented, and this page intentionally does not publish a fixed exhaustive list.

Use the name, description, and input schema returned by discovery rather than guessing a tool call from an older example. A successful MCP connection proves protocol access only; each tool still enforces the session's Tabbify scope.

For REST operations, use the generated OpenAPI document at https://api.tabbify.io/openapi.json; REST coverage is not an implied MCP tool list.

See the Node API for REST discovery, the deploy pipeline for deployment semantics, and auth for credential boundaries.