Quick Start
1. Start Services
2. Set Service Token
AddSTUDIO_AGENT_SERVICE_TOKEN to your .env file:
3. Create an Agent Token
Open the Studio UI, navigate to Agent Access, click Create Token, enter a name and duration, then copy the generated token.4. Connect Your MCP Client
Authentication Methods
Temporary Tokens
Best for interactive sessions, testing, and short-lived tasks.
Include the token as a Bearer header:
OAuth2 Client Credentials
Best for automated pipelines, CI/CD, and long-running integrations.
Step 1 - Create client (one-time):
Create via the UI (Agent Access > OAuth2 Clients) or API. Save the
client_id and client_secret - the secret is shown only once.
Step 2 - Exchange credentials for tokens:
Comparison
MCP Client Configuration
The
"type": "http" field is required for Claude Code and most MCP clients.
Without it, the client may fail to connect.Claude Code
Add to~/.claude/mcp.json or your project’s .mcp.json:
Cursor
Add to.cursor/mcp.json:
Production (with SSL)
Tool Reference
All 45 tools return structured JSON. Pagination usesskip/limit parameters.
Connections (8 tools)
Tools (8 tools)
Resources (5 tools)
Prompts (5 tools)
Deploy (3 tools)
Export/Import (2 tools)
History (3 tools)
Monitoring (3 tools)
Server Config & Global Variables (7 tools)
Global variables are accessible in all Jinja2 transform templates as
{{ "{{ vars.key_name }}" }}.
Maximum 100 variables. Names must start with a letter or underscore.Flow (1 tool)
Rate Limiting
Each token is rate-limited to a configurable number of requests per minute (default: 120). Configure viaSTUDIO_AGENT_RATE_LIMIT env variable or Studio settings.
Activity Log
All agent tool calls are recorded in Redis with timestamp, token prefix, tool name, client IP, and success status. View in the UI on the Agent Access page or viaGET /api/v1/agent-activity.
Security Best Practices
- Use short-lived tokens for testing (15-30 minutes)
- Rotate OAuth2 client secrets periodically
- Set a strong service token (
STUDIO_AGENT_SERVICE_TOKEN) - Monitor the activity log for unexpected patterns
- Use dedicated domains in production for better isolation
- Revoke tokens immediately when compromised
Environment Variables
Troubleshooting
Agent can’t connect
- Verify the agent-mcp container is running:
docker compose ps - Check health:
curl http://localhost:3000/agent-mcp/health - Verify
STUDIO_AGENT_SERVICE_TOKENis set in both backend and agent-mcp environments - Check logs:
docker compose logs agent-mcp
Tool calls return 401
- Ensure
STUDIO_AGENT_SERVICE_TOKENmatches in both the backend and agent-mcp containers - Verify the backend is running and healthy:
curl http://localhost:3000/api/health - The backend must use
get_agent_or_admin(notget_current_admin) for all API endpoints that the agent accesses
Token rejected
- Confirm the token hasn’t expired
- Verify it hasn’t been revoked
- Check rate limits
OAuth flow fails
- Ensure
client_idandclient_secretare correct - Check the grant_type is
client_credentialsorrefresh_token - Verify the OAuth client hasn’t been revoked
See Also
REST API
Full REST API reference for all endpoints
Security
Authentication, token security, and encryption
Deployment
Deploy and connect to the MCP server
SSL/HTTPS Setup
Enable HTTPS for production Agent MCP access
Configuration
Agent MCP environment variables
Troubleshooting
Common issues and debugging tips