Connecting

Connecting takes about 5 minutes: add the server URL to your client, sign in with your CloudQuell account in the browser, and start asking questions.

The endpoint:

https://mcp.cloudquell.com/mcp

When you connect, the client opens the CloudQuell sign-in page in your browser. Sign in (email/password or Google — the same login you use for the dashboard). You are asked to sign in each time you add a new connection, even if you are already signed in to CloudQuell, so a connection can only be created by someone who knows the account’s credentials. Your connector receives both scopes (read and admin:write) — Cognito offers no per-scope consent toggle — but in practice a new connection is read-only, because MCP writes are off by default for every organization. An org admin turns them on at Settings → Organization → AI agent access, and even then a write needs an admin role and confirm: true. See Authentication & authorization for the full model. Once approved, the browser hands a short-lived token back to your client and you’re connected.

MCP access is a paid feature. Connecting and listing tools works on any plan, but actually calling a tool requires your organization to be on a paid CloudQuell plan — a Free org gets an upgrade_required response on every tool call. See Access, limits & data scope.

---

Claude — claude.ai / Claude.com (connector)

1. Open Settings → Connectors (or Settings → Connectors → Add custom connector).
2. Name: CloudQuell. URL: paste the endpoint above.
3. Click Add / Connect. A CloudQuell sign-in window opens — log in and Approve.
4. In a chat, open the tools/connector menu and confirm CloudQuell is enabled. Ask: “Using CloudQuell, what’s our month-to-date AWS spend vs last month?”

To disconnect later: Settings → Connectors → CloudQuell → Remove, then revoke the session (see Revoking access below).

ChatGPT

1. Go to chatgpt.com/plugins, select the + button, then Add custom MCP server.
2. Name: CloudQuell. Add a short description if you like.
3. Under Connection, paste the endpoint above and choose OAuth for authentication.
4. Read the risk notice, select I understand and want to continue, then Create as a plugin.
5. The CloudQuell sign-in page opens. Sign in with your CloudQuell account, and ChatGPT returns to the chat connected.
6. Ask: “Using CloudQuell, what’s our month-to-date AWS spend vs last month?”

Custom MCP servers are subject to your ChatGPT plan and workspace settings. If you don’t see Add custom MCP server, ask your ChatGPT workspace admin whether custom connectors are allowed.

To disconnect later, remove CloudQuell from chatgpt.com/plugins.

Claude Desktop (macOS / Windows)

Option A — Custom connector (recommended on current builds): same as claude.ai above, under Settings → Connectors → Add custom connector.

Option B — config file (works on any build): add the mcp-remote bridge to claude_desktop_config.json (Settings → Developer → Edit Config):

{
  "mcpServers": {
    "cloudquell": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.cloudquell.com/mcp"
      ]
    }
  }
}

Restart Claude Desktop. On first use, mcp-remote opens your browser for the CloudQuell login. Requires Node.js 18+.

Claude Code (CLI)

claude mcp add --transport http cloudquell \
  https://mcp.cloudquell.com/mcp

Run claude, and on first tool use a browser opens for the OAuth login. Check status with claude mcp list; remove with claude mcp remove cloudquell.

Cursor

Cursor’s built-in sign-in for remote servers isn’t supported yet, so connect through the mcp-remote bridge. Add it to ~/.cursor/mcp.json (global) or .cursor/mcp.json in a project:

{
  "mcpServers": {
    "cloudquell": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://mcp.cloudquell.com/mcp"]
    }
  }
}

Open Settings → MCP and enable cloudquell. On first use, mcp-remote opens your browser for the CloudQuell login. Requires Node.js 18+.

Goose

goose configure
# → Add Extension → Remote Extension (Streaming HTTP)
# Name: cloudquell
# URL:  https://mcp.cloudquell.com/mcp

Goose opens the browser for OAuth on first use. You can also add it under the extensions: block of ~/.config/goose/config.yaml as a streamable_http type pointing at the same URL.

Codex (OpenAI Codex CLI)

Codex speaks stdio, so bridge with mcp-remote in ~/.codex/config.toml:

[mcp_servers.cloudquell]
command = "npx"
args = ["-y", "mcp-remote", "https://mcp.cloudquell.com/mcp"]

The first run opens your browser for the CloudQuell login.

Any other MCP client

Point the client at the MCP URL and let it discover the rest. The server publishes:

• GET /.well-known/oauth-protected-resource (RFC 9728)
• GET /.well-known/oauth-authorization-server (RFC 8414)
• POST /register (RFC 7591 Dynamic Client Registration shim)

so a compliant client needs no pre-issued client id or secret — it registers itself, runs Authorization Code + PKCE through the CloudQuell sign-in page, and connects. If the client is stdio-only, wrap the URL with npx -y mcp-remote <url>.

Verify with MCP Inspector

# List tools (after obtaining an access token, e.g. via mcp-remote or the Inspector UI):
npx @modelcontextprotocol/inspector --cli \
  https://mcp.cloudquell.com/mcp \
  --transport http \
  --header "Authorization: Bearer $ACCESS_TOKEN" \
  --method tools/list

You can also run the Inspector UI (npx @modelcontextprotocol/inspector), choose Streamable HTTP, paste the URL, and let it drive the OAuth login.

A quick unauthenticated health check (no login needed):

curl -s https://mcp.cloudquell.com/health
# → {"status":"ok","version":"0.7.0"}

---

The login flow (what happens behind the scenes)

1. Your client reads the server’s sign-in details and registers itself. No client id or secret needs to be issued in advance.
2. The client sends you to mcp.cloudquell.com, which checks that the client’s return address belongs to a supported app before going any further, then shows you the CloudQuell sign-in page.
3. You sign in (email/password or Google).
4. CloudQuell sends you back to your app with a one-time code that only that app can use, and the app exchanges it for a short-lived access token plus a refresh token.
5. Every MCP request carries that token; the server validates it, resolves your organization, and forwards a scoped token to the backend.

You only do steps 2–4 once per connection; the refresh token keeps the connection alive after the access token expires.

Revoking access

• Remove the connector / server entry in your client (this stops it using the token).
• For mcp-remote: delete its cached credentials at ~/.mcp-auth/ to force a fresh login next time.
• Revoke the CloudQuell session so the refresh token can no longer mint new access tokens: sign out of CloudQuell, or have an org admin revoke the session. Access tokens are short-lived (~1 hour) and expire on their own; revoking the refresh token ends the connection for good.

See Security & privacy for the full token model.