Configuration

MCP API

Connect Claude Code, Codex and other AI clients to this server

Remote Management API

Management MCP

https://utils.demo.clace.io/_openrun/mcp
disabled

Lets an AI client operate OpenRun as you: list and create apps, promote, manage services and bindings, run syncs. Enabling needs:

  • ✓ RBAC enforcement - always on
  • ✓ HTTPS listener or a trusted TLS proxy - HTTPS listener on
  • ✓ External URL - https://utils.demo.clace.io
api.mcp.auth

browser login mechanisms for MCP OAuth clients (API keys minted with --resource mcp work regardless); at least one is required, admin by default

Additional settings
api.mcp.enable_apis

dangerous operations disabled for MCP by default, opted back in (logged at startup)

api.mcp.disable_apis

operations turned off for MCP on top of the defaults; secret_create is on by default, disable it if secret values must never pass through an AI client

api.mcp.skip_destructive_confirm

disable the dry-run preview + confirmation prompt on destructive MCP tools (headless automation)

App actions MCP

https://utils.demo.clace.io/_openrun/app_mcp
enabled
Connect a client - Claude Code, Codex, any MCP client

Pick the login the client connects with and, optionally, an app path glob to narrow the view. Without a login only apps with auth none are visible. The openrun_status tool reports who is connected and what the view holds.

Apps: a path glob like /team/** or example.com:/**; empty means all

Claude Code
claude mcp add --transport http openrun-apps "https://utils.demo.clace.io/_openrun/app_mcp"
Codex
codex mcp add openrun-apps --url "https://utils.demo.clace.io/_openrun/app_mcp"
Any MCP client (streamable HTTP)
https://utils.demo.clace.io/_openrun/app_mcp

Your apps with actions

App Actions
/weather 3 actions actions · detail
utils.demo.clace.io:/dict 1 action actions · detail
utils.demo.clace.io:/list_files 1 action actions · detail
utils.demo.clace.io:/num_lines 1 action actions · detail

Each app also serves its actions on its own /mcp url with the app's own login; setting an app's MCP to disable (its edit form) removes it from every tool list.

Additional settings
api.app_mcp.allowed_auth

logins the url's ?auth= param may name; none selected allows every configured login

api.app_mcp.max_tools

the tool list fails above this many tools, asking for a narrower ?apps= glob (default 300)

api.app_mcp.list_ttl

freshness hint of the tool list for clients (Go duration, default 3m)