Client Setup

Connect your AI client to https://app.cranl.com/api/mcp. The first time it connects, a browser window opens and you approve the sign-in.

Tip

cranl init offers to set up Claude Code, Cursor, VS Code and Windsurf for you. cranl mcp --print prints the config to copy into any other client.

Claude Code 

claude mcp add --transport http cranl https://app.cranl.com/api/mcp

Cursor 

Add to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "cranl": {
      "url": "https://app.cranl.com/api/mcp"
    }
  }
}

VS Code 

Add to .vscode/mcp.json:

{
  "servers": {
    "cranl": {
      "type": "http",
      "url": "https://app.cranl.com/api/mcp"
    }
  }
}

Windsurf 

Add to ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "cranl": {
      "serverUrl": "https://app.cranl.com/api/mcp"
    }
  }
}

Clients that only support stdio 

cranl mcp

cranl mcp runs a local stdio server that forwards to the remote one, using the CLI’s login. Sign in first with cranl login. Point your client at the cranl mcp command.

Choosing toolsets 

Add query parameters to the URL to change which tools load:

# Every operation
claude mcp add --transport http cranl "https://app.cranl.com/api/mcp?toolsets=all"

# core plus email and storage
claude mcp add --transport http cranl "https://app.cranl.com/api/mcp?toolsets=email,storage"

# Read-only operations only
claude mcp add --transport http cranl "https://app.cranl.com/api/mcp?readonly=1"

See MCP Tools for what each option loads.

Using an API key instead of OAuth 

For CI or clients without OAuth support, send an API key in the Authorization header:

claude mcp add --transport http cranl https://app.cranl.com/api/mcp \
  --header "Authorization: Bearer cranl_sk_YOUR_API_KEY"

The key’s scopes decide which tools can run. See Authentication.

Verification 

Ask your assistant: “Who am I on CranL?” It should call whoami and show your account and what the credential can do. Then try “List my CranL apps”.

Troubleshooting 

No browser window opens

Make sure your client supports OAuth for remote MCP servers. If it doesn’t, use cranl mcp (stdio) or an API key header.

“Unauthorized” or “invalid token” errors

Sign in again (remove and re-add the server), or check the API key:

It starts with cranl_sk_.
The header is Authorization: Bearer cranl_sk_..., with the Bearer prefix.
It hasn’t been revoked or expired.

See unauthorized and invalid_token.

A tool fails with insufficient_scope

The key doesn’t have the scope that operation needs. Use a key with that scope, or sign in with OAuth. See insufficient_scope.

A tool isn’t available

Only the default toolsets load. Ask the assistant to use find_tools, or add ?toolsets=… to the URL. Restart your client after changing its MCP configuration.