Skip to documentation
Code Voucherby Pyratz
Open
Browse documentation
How-to guideMCP integration

Connect your coding agent to Code Voucher

Use the Model Context Protocol (MCP) to inspect repositories, read review findings, and request supported workspace operations from a compatible AI client.

What you can do

  • Read connected repositories, review runs, findings, and Agentic QA status.
  • As an owner or administrator, discover repositories through an existing provider connection, request onboarding, inspect setup readiness, and configure supported review settings.
  • With write permission, request eligible operational review recovery, record finding decisions with a rationale, and request or approve bounded patch generation.
  • With separate remediation permission, request publication of an unchanged validated patch as a draft GitLab merge request. GitHub remediation is not supported.
  • With team permission, manage supported member and invitation workflows.

Availability depends on your workspace role, token scopes, provider, and repository configuration. Long-running operations return an operation or proposal ID; ask the client to check its status. MCP does not provide arbitrary shell commands, prompts, provider credentials, merges, or billing changes. Existing publication policies still apply.

Create an access token

  1. 1

    Choose your workspace

    Sign in to Code Voucher, select the workspace you want the agent to access, and open Settings → MCP access.
  2. 2

    Name the client and choose an expiry

    Under Create a token, use a recognizable name such as Local coding agent. Choose 30 days, 90 days, or 1 year.
  3. 3

    Choose permissions

    Read workspace data is required. Start with this permission for inspecting reviews. Owners and administrators can add repository operations, team access, and remediation publication permissions when needed.
  4. 4

    Create and copy the token

    Select Create token and copy the value immediately. It starts with cv_mcp_ and is shown only once. Store it in your client's secret or credential settings, outside source control.

A token belongs to one user and one workspace and always acts with that user's current role. It cannot grant more access than the user has.

platform:read reads workspace data; platform:write permits supported repository operations; team:write permits team operations. Draft remediation publication requires both platform:write and remediation:write. Write permissions are available only to owners and administrators.

Open workspace Settings

Connect your MCP client

Add a remote MCP server in a client that supports Streamable HTTP and a custom bearer authorization header. Use these connection settings:

Hosted connection settings
Name: Code Voucher
Transport: Streamable HTTP
URL: https://code-voucher.pyratz.com/mcp
Authorization: Bearer <your MCP token>

Replace the placeholder with the token you just copied. If the client has a dedicated bearer-token field, enter only the token there. For a self-hosted deployment, use your own HTTPS base URL followed by /mcp. For local backend development, use http://localhost:8000/mcp.

Configure a manually issued token; an interactive OAuth sign-in flow is not currently provided. A client that requires OAuth and cannot accept a bearer token will need another supported connection method.

Try a first request

Once connected, ask your agent to discover the available tools and start with a read:

Example prompts
Show the Code Voucher capabilities available to me.
List my connected repositories.
Find the latest review run for my repository and summarize its blocking findings.

Useful starting tools include get_platform_capabilities, list_repositories, list_runs, and get_review_status. Ask the agent to use returned repository and run IDs when inspecting results. Review a proposed write before authorizing your agent to perform it.

Revoke tokens and troubleshoot

  • Revoke a token in Settings → MCP access when a client is retired or a token is exposed. Create a replacement and update the client to rotate access; expired tokens must also be replaced.
  • You can revoke your own tokens. Owners and administrators can also review the workspace token inventory and revoke other members' tokens.
  • If authentication fails, check the endpoint and bearer header, expiry, revocation, and whether your account and workspace membership are still active.
  • If an operation is denied, check both the token's scopes and your current role. A successful connection does not grant every tool permission.
  • If the client cannot connect, confirm it supports Streamable HTTP with bearer authentication. Opening /mcp in a browser is not a connection test.