MCP server setup

╭────────────────────────────╮
│  🔌 Molar MCP              │
│  One install · all products │
╰────────────────────────────╯

Molar exposes Cartographer, Guard, Clones, and Trace as MCP tools so coding agents can generate scenarios, run tests, drive clones, and read traces without a custom integration.

No account yet? Agent self-serve

Coding agents can register without a dashboard login:

1. Agent self-serve signup — POST /api/v1/agent-signup or molar agent signup
2. Human verifies with a 6-digit email code
3. Connect via mcp.molar.it (or paste https://api.molar.it/mcp into your client)

Pre-verify tokens get mcp:read + mcp:run only. After verify, scopes expand to mcp:read, mcp:write, mcp:run, and mcp:trace:read on the Free tier. High-risk scopes (mcp:explore, mcp:act, mcp:approve, mcp:identity, mcp:clone:write, mcp:debug) require explicit OAuth consent or a higher plan.

Human engineers should still use app.molar.it for billing, GitHub App install, and team invites.

Install in your coding tool

Visit mcp.molar.it — 25 clients with honest install paths (deeplink, copy command, or copy URL). Fake claude://mcp/install links are gone: Claude Desktop uses Settings → Connectors → Add custom connector with https://api.molar.it/mcp.

Manual JSON (most URL-transport clients):

{
  "mcpServers": {
    "molar": { "url": "https://api.molar.it/mcp" }
  }
}

Windsurf uses serverUrl instead of url — use the Windsurf card on mcp.molar.it.

Cursor

Open mcp.molar.it → Cursor, or add a workspace server:

{
  "mcpServers": {
    "molar": { "url": "https://api.molar.it/mcp" }
  }
}

Save as .cursor/mcp.json, then Settings → MCP → molar → Authenticate. Complete OAuth 2.1 + PKCE (consent lists scopes; resource is https://api.molar.it).

Claude Code

claude mcp add --transport http molar https://api.molar.it/mcp

Local stdio

molar mcp serve

Optional flags: --cloud-access, --surfaces=cartographer,clones,guards,trace, --transport=http, --port=4200.

Client config:

{
  "mcpServers": {
    "molar-local": {
      "command": "molar",
      "args": ["mcp", "serve"]
    }
  }
}

Use --cloud-access for cloud-backed tools (failures, incidents, debugger) using credentials from ~/.config/molar/config.toml.

OAuth scopes

Ten scopes are defined in the auth layer. The consent screen lists all requested scopes. Hosted clients that omit scope at DCR receive the full advertised ceiling; org role + consent still gate the grant.

Authorization server: https://api.molar.it. Protected resource indicator: https://api.molar.it (clients may also send a trailing slash or /mcp; the AS canonicalizes to the origin).

Tool catalog (sample)

Full manifest: 82 tools across Cartographer (54), Guard (13), Clones (7), and Trace (8) — one MCP install covers all four surfaces. High-risk tools (molar_explore_target, molar_run_task, molar_provision_identity, …) require the matching high-risk scope via OAuth consent.

Resources & prompts

Resources: molar://scenarios/{slug}, molar://runs/{id}, molar://runs/{id}/trace, molar://traces/{id}, molar://incidents/{id}, molar://mender/prs/{id}, molar://flows/{id}, molar://pages/{url}, molar://context-index

Prompts: fix_failing_tests, investigate_incident, summarize_guard_24h, generate_scenarios_feature

Rate limits

100 requests per 60 seconds per access token on the hosted MCP server. Org usage is also metered as mcp_call — see Billing at app.molar.it.

Related

• Agent self-serve signup — no account? agent registers, human verifies
• OAuth & authentication
• Unified CLI
• Troubleshooting — MCP