Connecting

Connecting takes about 5 minutes: add the server URL to your client, sign in with your CloudQuell account in the browser, and start asking questions.

The endpoint:

https://mcp.cloudquell.com/mcp

When you connect for the first time, the client opens the CloudQuell Hosted UI in your browser. Sign in (email/password or Google — the same login you use for the dashboard) and approve the requested access. By default you’ll be granted read-only access; see Authentication & authorization for the scope model. Once approved, the browser hands a short-lived token back to your client and you’re connected.

MCP access is a paid feature. Connecting and listing tools works on any plan, but actually calling a tool requires your organization to be on a paid CloudQuell plan — a Free org gets an upgrade_required response on every tool call. See Access, limits & data scope.

---

Claude — claude.ai / Claude.com (connector)

1. Open Settings → Connectors (or Settings → Connectors → Add custom connector).
2. Name: CloudQuell. URL: paste the endpoint above.
3. Click Add / Connect. A CloudQuell sign-in window opens — log in and Approve.
4. In a chat, open the tools/connector menu and confirm CloudQuell is enabled. Ask: “Using CloudQuell, what’s our month-to-date AWS spend vs last month?”

To disconnect later: Settings → Connectors → CloudQuell → Remove, then revoke the session (see Revoking access below).

Claude Desktop (macOS / Windows)

Option A — Custom connector (recommended on current builds): same as claude.ai above, under Settings → Connectors → Add custom connector.

Option B — config file (works on any build): add the mcp-remote bridge to claude_desktop_config.json (Settings → Developer → Edit Config):

{
  "mcpServers": {
    "cloudquell": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.cloudquell.com/mcp"
      ]
    }
  }
}

Restart Claude Desktop. On first use, mcp-remote opens your browser for the CloudQuell login. Requires Node.js 18+.

Claude Code (CLI)

claude mcp add --transport http cloudquell \
  https://mcp.cloudquell.com/mcp

Run claude, and on first tool use a browser opens for the OAuth login. Check status with claude mcp list; remove with claude mcp remove cloudquell.

Cursor

Add a remote MCP server to ~/.cursor/mcp.json (global) or .cursor/mcp.json in a project:

{
  "mcpServers": {
    "cloudquell": {
      "url": "https://mcp.cloudquell.com/mcp"
    }
  }
}

Open Settings → MCP, find cloudquell, and click Login / Authenticate to run the OAuth flow. A green dot means it’s connected. (If your Cursor build doesn’t support remote url servers, use the mcp-remote command form shown for Claude Desktop Option B.)

Goose

goose configure
# → Add Extension → Remote Extension (Streaming HTTP)
# Name: cloudquell
# URL:  https://mcp.cloudquell.com/mcp

Goose opens the browser for OAuth on first use. You can also add it under the extensions: block of ~/.config/goose/config.yaml as a streamable_http type pointing at the same URL.

Codex (OpenAI Codex CLI)

Codex speaks stdio, so bridge with mcp-remote in ~/.codex/config.toml:

[mcp_servers.cloudquell]
command = "npx"
args = ["-y", "mcp-remote", "https://mcp.cloudquell.com/mcp"]

The first run opens your browser for the CloudQuell login.

Any other MCP client

Point the client at the MCP URL and let it discover the rest. The server publishes:

• GET /.well-known/oauth-protected-resource (RFC 9728)
• GET /.well-known/oauth-authorization-server (RFC 8414)
• POST /register (RFC 7591 Dynamic Client Registration shim)

so a compliant client needs no pre-issued client id or secret — it registers itself, runs Authorization Code + PKCE against the CloudQuell Hosted UI, and connects. If the client is stdio-only, wrap the URL with npx -y mcp-remote <url>.

Verify with MCP Inspector

# List tools (after obtaining an access token, e.g. via mcp-remote or the Inspector UI):
npx @modelcontextprotocol/inspector --cli \
  https://mcp.cloudquell.com/mcp \
  --transport http \
  --header "Authorization: Bearer $ACCESS_TOKEN" \
  --method tools/list

You can also run the Inspector UI (npx @modelcontextprotocol/inspector), choose Streamable HTTP, paste the URL, and let it drive the OAuth login.

A quick unauthenticated health check (no login needed):

curl -s https://mcp.cloudquell.com/health
# → {"status":"ok","version":"0.1.0"}

---

The login & consent flow (what happens behind the scenes)

1. Your client fetches the server’s protected-resource metadata and registers itself via /register (the server returns its shared public PKCE client id).
2. The client opens the CloudQuell Hosted UI (cloudquell-prod-auth.auth.us-west-2.amazoncognito.com) with a PKCE challenge and a resource=https://mcp.cloudquell.com/mcp audience indicator.
3. You sign in (email/password or Google) and approve the requested scopes.
4. CloudQuell redirects back to the client’s callback with an authorization code; the client exchanges it (with the PKCE verifier) for a short-lived access token plus a refresh token.
5. Every MCP request carries that token; the server validates it, resolves your organization, and forwards a scoped token to the backend.

You only do steps 2–4 once; the refresh token keeps the connection alive after the access token expires.

Revoking access

• Remove the connector / server entry in your client (this stops it using the token).
• For mcp-remote: delete its cached credentials at ~/.mcp-auth/ to force a fresh login next time.
• Revoke the CloudQuell session so the refresh token can no longer mint new access tokens: sign out of CloudQuell, or have an org admin revoke the session. Access tokens are short-lived (~1 hour) and expire on their own; revoking the refresh token ends the connection for good.

See Security & privacy for the full token model.