MCP server

@saaspro/mcp puts SaaS Pro Max inside Claude Code, Claude Desktop, Cursor or any other Model Context Protocol host. The agent can then read your analytics, triage your errors, roll out a flag, and install the SDK into a codebase — with the same permissions the person holding the token has in the console.

It is a thin shell over the Management API: no state, no cache, no stored credential. Every authorization decision is made by the platform, so nothing about your security posture depends on the agent.

Connect from Claude#

The hosted MCP server is https://saaspro.dev/api/mcp. It works in Claude web, Desktop, mobile, Cowork and Claude Code using OAuth; no access token needs to be copied into a chat or configuration file.

1. Open SaaS Pro Max in Claude's connector directory.
2. Choose Connect. The published connector uses automatic OAuth registration.
3. If you use another deployment, add its /api/mcp address as a custom connector instead.
4. Sign in to SaaS Pro Max with Google and verify your passkey.
5. Review the requesting application and its return address, choose one organization and access level, enter a reason, and approve the connection.
6. Ask: “List my SaaS Pro Max applications,” or “Compare this week's traffic and errors with last week.”

New here? Create a free workspace before connecting. The coding agent connection guide introduces the available clients and example tasks. It is also linked during sign-up and under Account → Coding agents and MCP.

Your organization role must allow access-token creation (tokens.write). A free SaaS Pro Max workspace is sufficient; individual tools still require the relevant module, plan, permission and data. Connect again to choose a different organization. The connection cannot cross into your other organizations.

For Claude Code:

claude mcp add --transport http saaspro https://saaspro.dev/api/mcp

Run /mcp in Claude Code to complete authentication. Other remote MCP clients can use the same endpoint with OAuth dynamic client registration and PKCE S256. Only public OAuth clients (token_endpoint_auth_method: none) are supported.

Coding tools and other assistants#

Choose your client for copyable setup instructions. The hosted server uses Streamable HTTP and OAuth with dynamic client registration. Use a current client version and finish the browser sign-in before asking for your applications.

Instructions were checked against official documentation on October 9, 2026. These are direct MCP connections, not directory listings in every client. Client support does not mean every version or configuration has been tested with SaaS Pro Max. For a client without the hosted authentication flow, use the local installation below.

Access levels#

Read-only access is selected by default. Choose write or admin only when the assistant needs those tools. The consent screen names each requested scope: read for reports and data, write for module changes, admin for ingestion-key operations, and offline_access for refresh credentials. Scopes never override your role. The connector does not authorize payments, organization deletion, member administration or other operations that require a fresh console passkey.

Disconnect and privacy#

Revoke MCP connection in Account → Personal access tokens to immediately stop both access and refresh credentials, then disconnect it in Claude. Access tokens expire after one hour; refresh credentials rotate on every use and the connection expires after 30 days. Reusing a consumed code or refresh credential revokes the connection. Revocation, membership changes and current permissions are checked server-side on subsequent calls.

The connector shares only requested tool arguments and the resulting data with your chosen MCP client. PII remains permission-gated. SaaS Pro Max does not receive the surrounding Claude conversation; ask_saaspromax sends the explicit question to the platform assistant, whose configured model provider processes it under the existing assistant settings. Authorization and tool mutations are audited. OAuth codes and credentials are stored as hashes, never plaintext. See the privacy policy and contact hello@saaspro.dev for support.

Troubleshooting#

• Sign-in opens again: sign in with Google, then complete or refresh the passkey step; approval requires a passkey verified within 30 minutes.
• Requested scope is unavailable: ask an organization owner to check your role; the connector cannot grant permissions you do not already have.
• A module is disabled or a report is empty: enable the module and send data from an application before asking for its report.
• Connection expired or refresh replay detected: disconnect and reconnect.
• Registration fails: select automatic registration. This server advertises dynamic registration, not Client ID Metadata Documents.

Local installation#

claude mcp add saaspro --env SPM_TOKEN=spm_pat_xxxxxxxx -- npx -y @saaspro/mcp

Or write the configuration yourself. Claude Desktop (~/Library/Application Support/Claude/claude_desktop_config.json on macOS, %APPDATA%\Claude\claude_desktop_config.json on Windows):

{
  "mcpServers": {
    "saaspromax": {
      "command": "npx",
      "args": ["-y", "@saaspro/mcp"],
      "env": {
        "SPM_TOKEN": "spm_pat_xxxxxxxx",
        "SPM_HOST": "https://saaspro.dev"
      }
    }
  }
}

Cursor takes the same object in .cursor/mcp.json (per project) or ~/.cursor/mcp.json (global). VS Code uses .vscode/mcp.json with "type": "stdio".

Get a token from Organization → Access tokens (belongs to the team) or Account → Personal access tokens (acts as you).

Tools#

The discovery tools read the current OpenAPI contract on each call, so new Management API operations do not require another hand-written MCP wrapper. Search first, inspect the exact operation ID, then pass its named path, query and body parameters. Application settings use patchAppsByApp: read get_app first and send only changed fields. Module arrays replace the full list. Protected operations listed with consoleOnly: true name the shared command that performs them as command and use the shared command workflow: inspect that command's schema, prepare the exact inputs, let the member approve with a fresh passkey, then execute once. The connector cannot approve its own actions. Routine commands, marked execution: direct, run with execute_command and no approval. There are 44 MCP tools, 238 API operations and 239 shared commands. Code installation in another website is a deployment task, not an application setting.

For Cookieless visitors, call get_cookieless_status for every app. This report has no on/off setting: Analytics must be enabled and the site's server must send events to the dedicated endpoint. cookieless: true and privacyMode: ephemeral in the browser SDK are different collection modes. The get_install_instructions tool now also accepts React Native, Expo, WordPress and privacyMode for the supported frameworks.

Every dedicated app-scoped tool takes app, which accepts an application id or the orgSlug/appSlug form list_apps returns.

ask_saaspromax is the escape hatch: it runs the platform's own tool loop and returns a written answer with the tools it used. Prefer a specific tool when you know what you need — it is cheaper, and the raw data is easier to reason about.

When the assistant wants to change something#

The platform assistant can act, not only read, so ask_saaspromax has two kinds of outcome. A question that only needs reads comes back as an answer. A question that would change something comes back as an answer plus one or more proposed actions, each with an id, the tool it would call, its arguments, its effect (write, destructive or external) and a human-readable preview of the change. Nothing has been written at that point.

Approving is a separate call, against the assistant endpoints:

curl -X POST -H "Authorization: Bearer $SPM_TOKEN" -H 'content-type: application/json' \
  -d '{"reason":"Agreed in the release channel"}' \
  "$SPM_HOST/api/v1/apps/acme/site/ai/actions/act_1/approve"

GET /apps/{app}/ai/actions lists what is waiting, and /reject declines one with a reason. Approving executes the action, writes the audit row and resumes the conversation, so a later ask_saaspromax in the same conversation can report the outcome.

Two limits apply to an MCP host in particular:

• A token that could not perform the action itself cannot approve it. read scope can ask, and can watch proposals appear, but not approve them.
• The dedicated approval endpoint rejects a destructive action with passkey_required. Use the ai.decide-action shared command to obtain the member's exact passkey approval and execute through the protected handler.

The design is deliberate: an agent may propose, a person disposes. If your host wants direct writes instead, use the specific tool (upsert_flag, update_error_status, update_person) with a write-scoped token — those act as the token's owner and need no approval.

Resources#

saaspro://docs/{slug} serves the deployment's own documentation as markdown: SDK guides, module references, integration setup, the API reference. The list comes from GET /api/v1/docs, so it always matches the platform the token points at rather than a snapshot bundled with the server.

Prompts#

The agent skills go further: they carry per-framework reference tracking code and an output template, and they trigger on what you ask for rather than needing to be picked from a menu.

Security#

• Scope the token to the job. A read-only token is enough for reporting and error triage. write adds module data. admin adds public and secret keys — give it only when the agent is genuinely installing an SDK.
• Tokens are organization-scoped. An organization token reaches exactly one organization with the developer role. A personal token acts as its owner and reaches that owner's organizations, each with its own role permissions. Neither can delete an organization or an application, change members, or create further tokens: those need a console session with a fresh passkey.
• Nothing is stored on your machine. The token is read from the environment and forwarded as a bearer credential. It is never written to disk, never logged, and never included in a tool result. The server logs to stderr only — stdout carries JSON-RPC.
• Personal data stays gated. Emails and names are masked unless the token's bearer holds people.pii.read.
• Public and secret keys are shown once. create_api_key returns the value in that one response; only a hash is stored. Put it in an environment file, never in source and never in a chat transcript.
• Every write is audited as an action by the person the token belongs to, tagged via: management-api with the token's id — so a leaked token's blast radius is always answerable.
• Revocation is immediate. Revoke in the console and the next tool call fails; a personal token also dies the moment its owner leaves the organization.

Troubleshooting#

Debug against a real deployment with the inspector:

SPM_TOKEN=spm_pat_xxxxxxxx npx @modelcontextprotocol/inspector npx -y @saaspro/mcp