MCP integration

Connect DreamSparrow to your AI stack

DreamSparrow speaks the Model Context Protocol so any MCP-aware AI client — Claude Desktop, Cursor, Continue, Cline, or your own — can read your projects, create tasks, post comments, and run analytics as your user account.

Quick start (60 seconds)

1. Sign in
dreamsparrow.io → Settings → MCP Access.
2. Generate a token
Name the token so you remember which device it lives on (e.g. “My Laptop · Claude Desktop”). Pick an expiry or leave it as Never. The plaintext dsk_live_… is shown exactly once.
3. Connect your client
Pick your tool in the dialog’s tabs — the wizard hands you a one-click installer (Claude Desktop) or a copy-ready JSON / URL snippet.

Per-client setup

Claude Desktop

In DreamSparrow: Settings → MCP Access → Generate token.
Pick the Automatic tab → Download installer → run the printed command in your terminal.
Restart Claude Desktop, then ask: 'List all my DreamSparrow projects'.

If the installer script isn't usable on your system, switch to the Manual tab — the wizard emits the exact JSON to paste into claude_desktop_config.json.

Cursor

DreamSparrow: Settings → MCP Access → Generate token.
Copy the Cursor tab content from the token dialog.
In Cursor: Settings → Features → Model Context Protocol → Add new.
Paste Name + SSE URL (already includes ?token=…).

Cursor's MCP panel sends the token only on the SSE URL — the wizard hands you that URL pre-formed.

Continue

DreamSparrow: Settings → MCP Access → Generate token.
Open ~/.continue/config.json.
Paste the Continue tab block into experimental.modelContextProtocolServers.

Continue uses an Authorization header; the wizard formats the JSON block for you.

Cline / generic MCP client

Endpoint: https://dreamsparrow.io/api/mcp
Transport: SSE or Streamable HTTP
Auth: Authorization: Bearer dsk_live_…
Fallback (no-header clients): https://dreamsparrow.io/api/mcp?token=dsk_live_…

Both header and query-string auth are supported; use whichever your client allows.

Security model

Plaintext never stored

Only SHA-256(token) is persisted. The plaintext appears exactly once, on create or rotate. Lost a token? Rotate it; the old value is unrecoverable.

Per-user RLS

Tokens belong to the user that minted them; no cross-user access. The MCP auth middleware does the hash lookup with a service-role client, but that’s the only elevated read.

Bearer headers are never logged

Stripped before log sinks see the request. Last-used timestamp is stamped async so stale tokens can be spotted and revoked.

Expiry + revoke are immediate

Expired or revoked tokens 401 on the next MCP request. There is no grace window.

Troubleshooting

Symptom	Cause	Fix
"Server disconnected" right after starting Claude Desktop	Claude is using mcp-remote with env.MCP_AUTH_TOKEN, which mcp-remote doesn't read. The missing auth triggers OAuth discovery against /api/mcp/.well-known/… which returns a 404 HTML page; JSON.parse fails → disconnect.	Re-run the Automatic installer (or paste the current Manual snippet — both now use the --header flag).
"npx: command not found" during install	Node.js is not on PATH.	Install Node.js 20+ from https://nodejs.org or via brew / winget / apt. Reopen the terminal before retrying.
401 Unauthorized on every tool call	Token is expired, revoked, or mis-pasted.	Open Settings → MCP Access. If the token is marked revoked or missing, click Rotate to mint a new one and repaste the config. The old plaintext is unrecoverable by design.
Tool runs but returns empty data	Token authenticates as you — RLS still applies. You can only see workspaces and projects you're a member of.	Confirm membership in the DreamSparrow UI; ask a workspace admin to invite you if needed.

Video walkthrough

Video tutorial coming soon

Generate your first token →