Skip to content

Connect AI Assistants (MCP)

Watasu ships a hosted MCP (Model Context Protocol) server. Connect it to Claude or any MCP-capable client and your assistant can answer questions like “is the deploy green?”, “what failed in the last build?”, or “which add-ons does the billing app have” — directly from live platform state.

https://mcp.watasu.io/mcp

The MCP surface is read-only. An assistant connected through MCP can see app and build state; it cannot deploy, scale, change config, or read your secrets.

Most MCP clients only need the endpoint URL. Add https://mcp.watasu.io/mcp as a remote MCP server and the client walks you through the rest:

  1. The client registers itself automatically (dynamic client registration).
  2. Your browser opens a Watasu consent page.
  3. You choose what the connection can see: all your teams (including ones you join later) or specific teams only.
  4. The client receives a token and starts reading.

Tokens are short-lived and refresh automatically. You can revoke a connection at any time from the dashboard.

For scripted or headless MCP clients, a Watasu API key works directly as a bearer token:

Authorization: Bearer <your-api-key>

Create API keys in the dashboard. The key inherits your access — apps you can’t see, the assistant can’t see either — and can itself be scoped to specific teams.

The server exposes read-only resources:

ResourceWhat it answers
watasu://overviewAccount-wide summary — teams, apps, live status, latest builds, current issues
watasu://whoamiWhat identity and team scope this connection has
watasu://teams, watasu://teams/{team}/appsTeam and app inventory
watasu://apps, watasu://apps/statusAll accessible apps with health at a glance
watasu://apps/{app}One app’s details — URL, current release, latest build
watasu://apps/{app}/builds, .../builds/{number}Build history and individual build details
watasu://apps/{app}/builds/{number}/logsBuild log events for debugging a failed deploy
watasu://apps/{app}/builds/{number}/raw-outputRaw build output
watasu://apps/{app}/releases/latestLatest release status
watasu://apps/{app}/process-typesThe app’s formation — process types and sizes
watasu://apps/{app}/addons, watasu://addons/{name}Attached add-ons, plans, and status

Everything respects your access: team-scoped connections only see their teams, and apps you can’t access return nothing.

By design, the MCP surface excludes:

  • config var values and secrets — never exposed, redacted or absent entirely
  • database credentials and add-on connection details
  • billing data
  • runtime app logs (build logs only — use watasu logs or Grafana for runtime logs)
  • any write operation — no deploys, no scaling, no config changes, no destroys

If you want an assistant that acts on Watasu, give it the CLI in an environment you control. MCP is the safe default for visibility.

  • “Why did the last deploy of billing-api fail?” — the assistant reads the build log and tells you
  • a morning standup summary across every app in a team
  • letting a coding agent check that its push actually went live before moving on
  • an on-call assistant that triages “is it us or the deploy?” questions

OAuth registration and token endpoints are rate-limited per client and IP. If a client hammers them it gets 429 Too Many Requests with a Retry-After header. Normal assistant usage won’t get near the limits.