Connect any MCP client

What you need

Any agent or tool that speaks MCP over HTTP and can send a bearer token in a header can connect to Rabbot, not just Claude Code. You need two things: a token from Settings > Agent access (MCP) in your installed app (see the previous article if you have not minted one yet), and your client’s own way of adding an MCP server.

The connection details

Every client asks for the same two pieces, both shown on the Connect your agent box in Settings, the server URL with a copy button next to it:

• Server URL: https://app.rabbot.ai/mcp
• Auth header: Authorization: Bearer YOUR_TOKEN

Wherever your client asks for an MCP server, that URL and that header are the whole answer. Replace YOUR_TOKEN with the value you copied when you minted it.

JSON config for clients that want one

Some clients take a config file rather than a command line. The exact keys differ from client to client, so check your own client’s documentation, but the shape is usually close to this, again with your own token in place of YOUR_TOKEN:

{
  "mcpServers": {
    "rabbot": {
      "type": "http",
      "url": "https://app.rabbot.ai/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_TOKEN"
      }
    }
  }
}

Drop this into whichever configuration file your agent reads for its MCP servers, alongside any others it already has.

Confirming it worked

Ask the agent a plain question once it is connected, such as “what is blocking sales on my store right now” or “what did Rabbot catch this month”. A working connection answers from your store’s real data. If it cannot answer, or answers with an authorisation error, check that the header is exactly Authorization: Bearer YOUR_TOKEN with your real token in place, and that the token has not been revoked or replaced by a newer one.

What the connection can and cannot do

Whichever client you use, the token behind it is scoped to one store, and eight of the nine tools only read. The one tool that writes marks a finding as intentional so Rabbot stops raising it, and it refuses on anything blocking a sale, with two documented exceptions that can be intentional: a deliberate password gate or a custom purchase flow. Revoking the token from Settings cuts off that client immediately, whatever it is.