MCP Setup
Configure the Conduit Admin MCP server for development-time provisioning.
The Conduit MCP server exposes Admin API operations as tools so AI agents can provision schemas, users, and config during development. Never call MCP from application runtime code.
For AI agents
MCP is dev/deploy only. Apps use the Client API at port 3000 with user tokens. See Client vs Admin API.
Prerequisites
- Running Conduit instance with Admin API reachable (default port 3030)
- MCP transport enabled:
transports.mcp: truein admin config - Admin JWT or
cdt_API token (recommended for automation)
Cursor configuration
Add to .cursor/mcp.json:
{
"mcpServers": {
"conduit": {
"url": "http://localhost:3030/mcp?modules=authentication,database,storage,authorization",
"headers": {
"Authorization": "Bearer YOUR_ADMIN_JWT_OR_cdt_TOKEN"
}
}
}
}Protocol: Streamable HTTP (2025-06-18). Path is fixed at /mcp.
Module loading
On connect, only core and __meta__ load by default. Enable modules via the URL query:
| Need | Add to URL |
|---|---|
| Schemas, custom endpoints | database |
| Users, teams | authentication |
| Files | storage |
| ReBAC (incl. bulk relations) | authorization |
| Chat | chat |
| Email/SMS/push | communications (or email,push,sms) |
After changing the URL, reconnect MCP and call list_modules to verify loaded: true.
Authentication
| Method | Usage |
|---|---|
| Admin JWT | Short-lived; from admin login (POST /login) |
cdt_ API token | Long-lived; create via POST /api-tokens — shown once, ideal for MCP and CI |
Every request: Authorization: Bearer <token>.
API tokens (cdt_)
Create tokens on the Admin API (or via MCP post_apitokens once core tools are loaded):
curl -X POST http://localhost:3030/api-tokens \
-H "Authorization: Bearer <admin-jwt>" \
-H "Content-Type: application/json" \
-d '{"name":"cursor-mcp","expiresInDays":90}'Response includes the plaintext cdt_<random> token once. Store it in your MCP client config or secrets manager. List and revoke tokens with GET /api-tokens and DELETE /api-tokens/:id — values are never returned after creation.
API tokens bypass the masterkey header requirement and authenticate as the creating admin. Each token is scoped to that admin's privileges.
Routes excluded from MCP
Some Admin routes are marked mcp: false and never appear as MCP tools — use the Admin API or admin panel directly:
| Area | Excluded routes | Reason |
|---|---|---|
| Database | POST /database/schemas/import, all /database/introspection/* | Destructive bulk schema import and DB introspection need explicit operator intent |
| Auth bootstrap | POST /login, admin user/password/2FA routes | Session and credential flows — not agent-safe |
Schema export (GET /database/schemas/export) remains available via MCP. For GitOps-style full platform state, use GET /state/export / POST /state/import on the Admin API — see GitOps guide.
Tool naming
Admin routes map to tools: GET /database/schemas → get_database_schemas. See MCP tools reference.