Connect your harness (MCP)

Zonda Cloud offers a remote MCP server so your agent harness (Claude Code, Codex, opencode or another) can view and operate the apps in your account, using a personal token that you control.

What it is and what you need

Zonda Cloud offers an MCP server so that an agent harness (Claude Code, Codex, opencode or another) can operate the apps in your account. It is remote, lives at https://console.zondacloud.com/mcp (HTTP) and authenticates with a personal token.

Create a token

In the console, in the Connect section (console.zondacloud.com/tokens), create a token with a name, a scope (Read only or Read and operate) and an expiry of 30, 90, 180 or 365 days (90 by default).

The value starts with cwt_ and is shown only once: copy it when you create it. You can revoke it at any time. Each account can have up to 20 tokens.

What each scope can do

Read only: view apps, deployments, logs, metrics, variables (names only), domains, branches, databases and backups. Tools: whoami, get_account_usage, list_apps, get_app, list_deployments, get_deployment, get_deployment_build_logs, get_app_logs, get_app_metrics, list_env_var_names, list_domains, list_branches, list_databases, get_database, list_database_backups, get_database_logs.

Read and operate adds: redeploy, rollback, creating, changing and removing environment variables, linking and unlinking branches, adding, verifying, moving and removing domains, linking and unlinking databases, taking a manual backup of a database, and starting or stopping databases. Tools: redeploy_app, rollback_deployment, set_env_var, delete_env_var, bind_branch, unbind_branch, add_domain, verify_domain, move_domain, remove_domain, link_database, unlink_database, create_database_backup, start_database, stop_database.

What a token can never do

Delete apps or databases.
Create apps or databases.
Restore or load data.
Download files.
Rotate credentials.
Read the values of environment variables (only their names).
Manage the cluster, even if the account is an administration account.

A token sees only what its owner sees.

Connect your harness

Pick the harness you use and replace the token with your own.

Claude Code

A single command adds the server:

claude mcp add --transport http zondacloud https://console.zondacloud.com/mcp --header "Authorization: Bearer cwt_YOUR_TOKEN"

Inside Claude Code, /mcp shows whether the connection works.

Codex

In ~/.codex/config.toml add:

[mcp_servers.zondacloud]
url = "https://console.zondacloud.com/mcp"
bearer_token_env_var = "ZONDACLOUD_TOKEN"

And set the token in the environment where Codex runs:

export ZONDACLOUD_TOKEN=cwt_...

opencode

In opencode.json add:

{
  "mcp": {
    "zondacloud": {
      "type": "remote",
      "url": "https://console.zondacloud.com/mcp",
      "headers": {
        "Authorization": "Bearer {env:ZONDACLOUD_TOKEN}"
      }
    }
  }
}

With {env:ZONDACLOUD_TOKEN}, opencode reads the token from the ZONDACLOUD_TOKEN environment variable, so it is not written in the file.

Harnesses without HTTP support

If your harness cannot talk to remote MCP servers over HTTP, use the stdio bridge zondacloud-mcp. It is a binary downloaded from the cloud-web releases (zondacloud-mcp-linux-amd64 or zondacloud-mcp-linux-arm64) and reads the ZONDACLOUD_TOKEN variable and, optionally, ZONDACLOUD_URL.

The typical setup is a command with its environment (the exact format depends on your harness):

{
  "command": "zondacloud-mcp",
  "env": {
    "ZONDACLOUD_TOKEN": "cwt_YOUR_TOKEN"
  }
}

What to ask for

“Why did the last deployment of mi-app fail?”
“Roll mi-app back to the previous version.”
“Add the API_URL variable to mi-app.”

The harness picks the right tool. With a read-only token, requests that change something cannot be fulfilled.

Security

Use one token per harness, so you can revoke one without affecting the others.
Give it the shortest expiry that works for you.
If the harness does not need to operate, use a read-only token.
Do not store it in the repository: use an environment variable.
If it leaks or you stop using it, revoke it from the console, in Connect.