---
title: MCP server
sidebar:
  label: Overview
description: Let another agent, like Claude Code or Cursor, start chats in your AINOX App account, read the code they produce, and publish the apps.
---

AINOX App runs a [Model Context Protocol](https://modelcontextprotocol.io) server. Any MCP client you connect with your API key acts as you: it sees your threads, starts new ones, and publishes apps under your account.

## What an agent can do

| Task | Tools |
| --- | --- |
| Find your threads | `list_threads`, `get_thread` |
| Start a build, or ask for changes | `create_thread`, `send_message` |
| Follow the agent's reply | `get_thread`, `list_messages` |
| Answer the agent's questions | `resolve_tool_call` |
| Read the code | `list_files`, `read_file` |
| Ship it | `publish` |
| Cancel a reply | `stop_run` |

The agent inside AINOX App still does the building. Your MCP client sends it prompts, waits, and reads the result. See [Build an app over MCP](/mcp/workflow) for the loop and the [tool reference](/mcp/tools) for each tool.

## Endpoint

The server speaks MCP over Streamable HTTP at one path on the web app:

```txt
https://app-builder.poring.arkcube.com/api/mcp/code/mcp
```

The **Agent Access** page shows the same endpoint, with a copy button.

The transport is stateless: every request stands alone, so there is no session to open or keep alive.

## Quickstart

1. **Create an API key**

    Sign in to [AINOX App](https://app-builder.poring.arkcube.com) with Google, open your account menu in the sidebar, and choose **Agent Access**. Name the key after where it will live, such as `Claude Code on my laptop`, and select **Create key**.

    Copy the key right away. It is shown only once.

    Sign-in is open to Google accounts on `@inox.co.th` only.

2. **Add the server to your client**

    Store the key in an environment variable, then point your client at the endpoint. For Claude Code:

    ```sh
    export AINOX_API_KEY="paste-your-key-here"
    claude mcp add --transport http ainox https://app-builder.poring.arkcube.com/api/mcp/code/mcp \
      --header "Authorization: Bearer $AINOX_API_KEY"
    ```

    [Connect a client](/mcp/connect) has settings for Cursor, VS Code, Codex, and plain HTTP.

3. **Try it**

    Ask your agent something like:

    ```txt
    Use the ainox tools to build a one-page tip calculator, then publish it as tip-calc.
    ```

    It should call `create_thread`, poll `get_thread` until the reply finishes, and call `publish` once you are happy with the result.

## Authentication

Send the key on every request, in either header:

```http
Authorization: Bearer <key>
x-api-key: <key>
```

Without a valid key the server still answers `tools/list`, so clients can discover the tools, but every tool call fails with `Missing or invalid API key`. A key stops working when you revoke it, when it is disabled or expired, or when its owner's account is banned.

Each key allows **120 requests a minute**. One tool call can cost a client several requests, so a tight polling loop can reach it. See [Troubleshooting](/mcp/troubleshooting) if a working key starts failing.

:::warning[A key is your account]
Anything that holds the key can read every thread and publish apps as you. Keep it in an environment variable or secret store, not in a committed config file, and give each machine or tool its own key so you can revoke one without breaking the others.
:::

## Manage keys

The **Agent Access** page lists your keys newest first, with each key's first characters, when it was created, and when it was last used. Keys you create there don't expire. Keys marked **Disabled** or **Expired** are refused by the server.

Select **Revoke key** to delete a key. Agents using it lose access immediately, and it cannot be restored. Create a new key instead.