Connect an AI Agent (MCP)

Suga runs a hosted Model Context Protocol server that lets an AI agent drive your Suga account the way you would through the dashboard: list projects, edit environment configuration, set variables and secrets, watch deployments, and read logs. The server lives at a single endpoint:

https://dashboard.suga.app/api/mcp

It speaks streamable HTTP and authenticates with OAuth, so any MCP client that supports remote servers can connect with just the URL. No API keys to copy or rotate.

The safety model

The most important thing to understand before you connect an agent: the agent can prepare changes, but it can never deploy them. Every environment in Suga has a Draft (a working copy of its configuration) and a Deploy step that applies the Draft to running infrastructure. The MCP server only ever writes to the Draft. It has no apply, deploy, delete_project, or delete_environment tools, by design. When an agent makes a change, the tool response includes a deeplink back to the affected environment in the Suga UI. You open it, review the rendered diff, and click Deploy Changes yourself. That visual review is the gate that keeps a misread instruction or a hallucinated container spec from reaching production.

What an agent can do

View your projects, environments, and deployments
Create projects and environments, and edit draft configuration
Set and remove environment variables and secrets
Manage custom domains and connected GitHub repositories

What it can't do

Deploy or publish. Changes stay as drafts until you review and deploy them yourself
Read secret values. Secrets are write-only; only names and metadata are ever returned
Delete projects or environments

The agent acts as you: it can only see and touch the organizations you’re a member of, and every action is subject to your existing permissions.

Before you start

A Suga account. If you don’t have one, sign up first.
An MCP client that supports remote servers with OAuth (Claude Code, Cursor, Claude Desktop, and others).

Connect your agent

Claude Code
Cursor
Claude Desktop
Codex
Other clients

Add the server from your terminal:

claude mcp add --transport http suga https://dashboard.suga.app/api/mcp

Then start Claude Code and run /mcp. Select suga and choose Authenticate to open the Suga sign-in and approval flow in your browser. Once you approve, the tools are available in your session.

Add Suga to your ~/.cursor/mcp.json (global) or .cursor/mcp.json (per-project):

{
  "mcpServers": {
    "suga": {
      "url": "https://dashboard.suga.app/api/mcp"
    }
  }
}

Open Cursor Settings → MCP, find the suga server, and click Login (or Needs login) to complete the OAuth flow in your browser.

Open Settings → Connectors → Add custom connector, give it a name (e.g. Suga), and paste the URL:

https://dashboard.suga.app/api/mcp

Save, then click Connect and approve access in your browser.

Edit your Codex configuration (~/.codex/config.toml) to add the Suga MCP server:

[mcp_servers.suga]
url = "https://dashboard.suga.app/api/mcp"

Save, then authenticate with this command:

codex mcp login suga

Any client that supports remote MCP servers over streamable HTTP with OAuth can connect. Point it at:

https://dashboard.suga.app/api/mcp

The server supports OAuth dynamic client registration, so you don’t need to pre-register the client or supply a client ID. The OAuth flow starts automatically on first connect.

Authorize access

The first connection sends you through a browser flow:

You’re taken to the Suga login page. Sign in with the same account you use for the dashboard.

Review and approve

A consent screen shows exactly what the connected app can and can’t do. Confirm it’s the app you’re connecting, then approve.

Return to your agent

You’re redirected back and the connection completes. Your agent can now call Suga tools. You won’t need to repeat this unless you disconnect or the session expires.

A typical workflow

Once connected, you can ask your agent to work on Suga in plain language. A first deployment usually flows like this:

The agent creates a project and an environment.
It adds a container, either from an image or by connecting a GitHub repository to build from source.
It sets any environment variables and secrets the container needs.
It hands you a deeplink. You open it, review the pending changes, and click Deploy Changes.
The agent watches the deployment and reports back when it’s live.

Everything up to step 4 happens in the Draft. Nothing changes in your running infrastructure until you deploy.

Good to know

Secrets are write-only. An agent can set or rotate a secret, but no tool ever returns a secret’s value, only its name and metadata. New values take effect on your next deploy.
Building from source needs the GitHub App. Install the Suga GitHub App from the dashboard first; the agent can’t start that install flow itself.
Custom domains wait on DNS. A newly added domain stays pending until you add the DNS records the agent surfaces for it.

Deployments

How Drafts, Deploys, and rollbacks work

Environments

Projects, environments, and configuration

Logs

Reading logs from your services

Configuration

Environment variables, secrets, and references

Need help?

Join our Discord community for support
Email us at support@suga.app

Getting Started

Concepts

Reference

Comparisons

Support

Connect an AI Agent (MCP)

The safety model

What an agent can do

What it can't do

Before you start

Connect your agent

Authorize access

A typical workflow

Good to know

Deployments

Environments

Logs

Configuration

Need help?

​The safety model

What an agent can do

What it can't do

​Before you start

​Connect your agent

​Authorize access

​A typical workflow

​Good to know

​Related

Deployments

Environments

Logs

Configuration

​Need help?

The safety model

Before you start

Connect your agent

Authorize access

A typical workflow

Good to know

Related

Need help?