MCP server

Bolt Claw runs a hosted Model Context Protocol (MCP) server, so an AI assistant can manage your pages, posts, inbox, automations, leads and referral programs directly.

• Endpoint — https://mcp.boltclaw.ai/mcp (Streamable HTTP, stateless)
• Sign in — add it as a connector and approve it in your browser. No key to copy, no file to edit.
• Or bring a key — Authorization: Bearer bc_live_... still works, at the same endpoint and at https://boltclaw.ai/api/mcp.

The assistant can do exactly what you allowed, and nothing else. Every tool is one call to this API with a key, so the key's scopes, its rate limit and every rule on these pages apply unchanged. There is no second path.

Signing in

Add https://mcp.boltclaw.ai/mcp in your assistant's connector or MCP settings. It opens a Bolt Claw page in your browser where you choose:

• which workspaces the assistant may work in, and
• what it may do in them, one row per area set to No access, Read, or Read and write.

Approve, and the assistant is connected. The key is made by the server and never passes through the conversation — it is generated in Cloudflare, Bolt Claw only ever sees its SHA-256, and the assistant never sees it at all. You can see the connection, change its permissions, or end it, under Settings → AI agents — and ending it there is what actually ends it.

A connection lasts 90 days and renews itself while it is in use, up to a year; after that you sign in again. Signing out in your assistant ("clear authentication", "disconnect") revokes the key too.

Several workspaces, one connection. Tools act on the connection's default workspace unless the assistant passes workspace (an id or name from list_workspaces). Each workspace gets its own key behind the scenes, so a refusal in one is a refusal in one.

What an assistant can never do

Whatever you grant it, a connection's key cannot carry keys:*, webhooks:*, referrals:embed or referrals:payouts at all — refused in the database at the sign-in, at every later edit, and on every request. A credential acting on its own should not be able to issue credentials or point your data at a new address, and it sends a referral payout batch only after a person who is signed in with two-step verification approves it.

The same goes for the AI agent settings themselves, approving its own requests, changing your access or anyone else's, deleting a workspace or the organisation, card details, plan changes, connecting a social account, blocking somebody from a page, and payout details. So do the referral steps that need a credential or your own two-step session: connecting a billing system, a payout account or a Shopify shop, your tax details and the 1099 files, and exporting a waitlist's email addresses. Ask an assistant to do one and it will give you the dashboard link, and tell you what it can do instead, rather than trying.

Asking first, and approvals

Two separate things sit between an assistant and anything consequential.

Confirmation is the assistant's. Any tool that publishes, replies, deletes or costs money answers "Nothing has been done" and describes the consequence until it is called again with confirm: true. Nothing is sent on the first call.

Approval is yours. For the actions listed under Agents, the API answers 428 APPROVAL_REQUIRED with a link to an approval page and nothing happens. You decide there; the assistant then retries the identical request with the approval id. An approval is bound to that exact request and the object it acts on, works once, and lapses after 24 hours.

Paying a partner, adjusting a commission, approving a referral partner and disconnecting a social account always ask, whatever your settings say. The rest can be waived by your organisation's approvals switch, or trusted for a few hours at a time.

Tools

Everything else is an action: find it with search_boltclaw_actions, then run it with read_boltclaw_action (a read) or run_boltclaw_action (a change). The catalog today:

Referral amounts are integers in minor units, in tools as in the API. record_referral_conversion takes the same fields as POST /v1/referrals/conversions, and its event_id is the same idempotency key: an assistant that retries sends the same event_id again (a repeat answers duplicate: true and changes nothing), and a 409 CONFLICT means "send the same request again" — never a new id. A conversion recorded through MCP is filed exactly as one sent to the API directly, so the two share one set of event_ids.

A tool call the API refuses comes back as a tool error carrying the API's error and code and what to do about it; a 429 says how many seconds to wait.

Resources and prompts

Two resources, both generated from this same specification and both readable with no key: boltclaw://api-reference (every endpoint, scope and rule) and boltclaw://error-codes (every code and what to change). The get_api_docs tool serves the same text for clients that do not read resources.

Three prompts, each a plan the assistant carries out through the ordinary tools: schedule-post, set-up-page and reply-to-inbox.

Setting it up

Claude Code

claude mcp add --transport http boltclaw https://mcp.boltclaw.ai/mcp

Then run /mcp and sign in when it asks.

Claude, ChatGPT and other web assistants — add a custom connector with the URL https://mcp.boltclaw.ai/mcp. They will open the sign-in for you.

Cursor (~/.cursor/mcp.json)

{
  "mcpServers": {
    "boltclaw": { "url": "https://mcp.boltclaw.ai/mcp" }
  }
}

VS Code (.vscode/mcp.json)

{
  "servers": {
    "boltclaw": { "type": "http", "url": "https://mcp.boltclaw.ai/mcp" }
  }
}

With an API key instead

Any client that lets you set a header can send a key, with no sign-in:

claude mcp add --transport http boltclaw https://mcp.boltclaw.ai/mcp \
  --header "Authorization: Bearer bc_live_..."

The config file then holds a credential, so keep it out of a repository. A key used this way is its one workspace, and workspace is not accepted.

Give the assistant a key made for it, with the scopes you want it to have — and leave out leads:read unless it genuinely needs other people's contact details. Signing in is better: a key you paste has no connection behind it, so Settings → AI agents cannot show it to you or end it.