Remote MCP

Query request history from your IDE.

When a webhook fails, a coding agent in your editor can list Mercur HTTP history and open the payload that arrived — instead of you copying JSON or logs into the conversation. Then you fix the handler and Retry from the console.

Read MCP docs Webhook Inspector

The failing payload is already in Mercur

Request history already has the method, headers, and body the provider sent. Pasting that into an editor chat is slow and easy to get wrong. Remote MCP lets the client query the same workspace history you see in the console.

MCP is not unique to Mercur

MCP is a standard protocol many products speak. The useful part here is the context: workspace HTTP request history (and optional inbound mail) in the same Connect → inspect → replay loop — not the protocol itself.

Workflow

Failing request to a code fix

Step 1

A webhook fails on a workspace HTTP endpoint

Point the provider at a Mercur HTTP endpoint that forwards to localhost. Guest Webhook Inspector traffic is not visible over MCP — Connect the endpoint first.

Step 2

Ask the MCP client to inspect

list_endpoints, then list_requests (filter by status or path), then get_request for the failed id. Summaries omit bodies; detail includes headers and bodies.

Step 3

Fix the local handler

Change the code against the payload that actually arrived — signatures, headers, and body — instead of reconstructing the event from memory.

Step 4

Replay from the console

Retry re-sends the stored HTTP request through the live endpoint. MCP cannot replay, start the agent, or mutate traffic. Replay needs proxy mode, a connected agent, and a complete stored payload.

Tools

What the MCP server exposes

Read-only HTTP tools. list_endpoints may include WebSocket and TCP endpoints; list_requests and get_request only work for HTTP.

HTTP · read-only

list_endpoints() → { items }: Lists endpoints in the workspace (id, name, host, protocol, mode). Request-history tools only succeed for HTTP.
list_requests(endpointId, filters?) → { items, nextCursor }: Paginated HTTP request summaries (method, path, status, timing). Optional filters: path, method, status, sessionId, from, to. No headers or bodies.
get_request(endpointId, requestId) → { item }: Full HTTP request/response for one log id, including headers and bodies. Bodies omitted when too large.

Read-only WebSocket tools. list_connections and get_connection only work for WS endpoints. Event lists omit payloads; get_connection_event returns the stored frame.

WebSocket · read-only

list_connections(endpointId, filters?) → { items, nextCursor }: Paginated WebSocket connection summaries (path, state, timing). Optional filters: path, state. No handshake headers or payloads.
get_connection(endpointId, connectionId) → { item }: One connection’s handshake (path, query, headers, close). No frame payloads.
list_connection_events(endpointId, connectionId, filters?) → { items, nextCursor }: Paginated lifecycle and message events (type, direction, size). No payloads.
get_connection_event(endpointId, connectionId, eventId) → { item }: Full event including stored payload when present. Payloads omitted when too large.

If you are debugging inbound mail on a temporary @mercur-mail.com inbox, the same server exposes mailbox tools. Summaries omit bodies; detail includes parsed content, not raw MIME or file bytes.

mail · read-only

list_mailboxes() → { items }: Lists temporary mailboxes in the workspace (id, address, name, forward target).
list_messages(mailboxId, limit?, cursor?) → { items, nextCursor }: Paginated inbound-mail summaries (from, subject, date) — no bodies.
get_message(mailboxId, messageId) → { item }: Full parsed message: headers, text, html, and attachment metadata. No raw MIME or file bytes.

Setup

Add Mercur to an MCP client

Paste this as a remote / HTTP MCP server. Cursor, Claude Desktop, and other clients that support remote MCP over HTTP and OAuth open a browser so you can sign in.

mcp.json · OAuth

{
  "mcpServers": {
    "mercur": {
      "url": "https://console.mercur.sh/api/mcp"
    }
  }
}

If the client cannot run OAuth, add a Bearer workspace API key. Replace the placeholder — never commit a real mcr_ secret.

mcp.json · API key

{
  "mcpServers": {
    "mercur": {
      "url": "https://console.mercur.sh/api/mcp",
      "headers": {
        "Authorization": "Bearer mcr_YOUR_WORKSPACE_KEY"
      }
    }
  }
}

How authentication works

The server is Streamable HTTP at https://console.mercur.sh/api/mcp. Prefer OAuth: paste the URL, sign in in the browser, and pick one Solo or Team workspace. If the client cannot run OAuth, create a workspace API key under Settings → Workspace → API keys and send Authorization: Bearer mcr_YOUR_WORKSPACE_KEY. Access is read-only (mcp:read), workspace-scoped, and rate-limited. Free and guest workspaces cannot authorize MCP. Revoke OAuth grants under Settings → Workspace → Connected MCP clients, or revoke the API key.

Security

What not to share

Remote MCP is read-only, but the tools can return stored request and mail content — including secrets that arrived in traffic.

Do not paste workspace API keys (mcr_…), OAuth access or refresh tokens, CLI tokens (mcrcli_…), or console session cookies into chats, tickets, or git.
A grant or key only sees one workspace. It cannot read another workspace’s endpoints or mail.
get_request, get_connection_event, and get_message return stored headers and bodies. Treat that output like production traffic logs.
Revoke OAuth grants under Settings → Workspace → Connected MCP clients, or revoke the API key. The client stops immediately.

Retention and stored-request limits: security and data retention.

Docs, tester, Connect, replay

FAQ

Remote MCP questions

What is Mercur remote MCP?

A Streamable HTTP MCP server on the Mercur console that exposes read-only tools for workspace HTTP request history, WebSocket connections, and inbound mail. MCP clients that support remote HTTP servers (Cursor, Claude Desktop, and others) connect with OAuth or a Bearer workspace API key — no local npm package. MCP itself is a standard protocol; Mercur’s value is the workspace traffic context.

Which plans include MCP?

Solo and Team. On Free, Settings shows an upgrade path to Pricing before you can authorize MCP or create a workspace API key.

How do I connect an MCP client?

Add https://console.mercur.sh/api/mcp as a remote / HTTP MCP server. The client signs you in with OAuth and you pick a workspace. API keys (url + Authorization header) remain an optional fallback. See the MCP docs and the Cursor walkthrough on the blog.

Can a key or grant read another workspace?

No. Keys and OAuth grants are workspace-scoped. Endpoint and mailbox tools only see data belonging to that workspace.

Can MCP replay a request?

No. MCP tools are read-only. After you change the handler, open the endpoint in the console and press Retry. Replay needs proxy mode, a connected agent, and a complete stored payload.

Does MCP see guest Webhook Inspector traffic?

No. The guest inspector is a browser-only URL. MCP only sees endpoints and mail in the Solo or Team workspace that owns the grant or API key. Connect localhost first, then inspect over MCP.

What credentials should I never share?

Never share workspace API keys (mcr_…), OAuth tokens, CLI tokens (mcrcli_…), or console sessions. get_request, get_connection_event, and get_message can include secrets that arrived in traffic. Revoke grants and keys in Workspace Settings.

Start

Inspect the payload that actually arrived

Add the remote MCP URL, sign in, and ask the client to list recent HTTP requests. After you fix the handler, Retry the stored request from the console.

Read MCP docs Webhook Inspector Create account