> ## Documentation Index
> Fetch the complete documentation index at: https://docs.errorbar.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP server

> The management API as MCP tools — 76 operations callable from Claude Code, Claude Desktop, Cursor, or any MCP client, with read-only and no-spend guards.

`@error-bar/mcp` exposes the [management API](/api-reference/introduction) as
MCP tools, so an agent can read your evals, pull failure clusters, compare two
models, or repoint an alias without you writing a single HTTP call. One tool per
API operation — **76 of them** — generated from the platform's route contracts,
so the tool surface cannot drift from the API it wraps.

Inputs are validated with the same field names and casing the REST API accepts,
and responses come back exactly as the API returned them (JSON pretty-printed,
exports as text), including the API's own error status and message. An agent
that has read [the API reference](/api-reference/introduction) already knows how
to drive this.

This is the *management* surface. To send inference through errorbar, point your
OpenAI client at [the gateway](/concepts/gateway) instead; to capture traffic
you're running elsewhere, see the [integration paths](/capture/overview).

## Connect

<CodeGroup>
  ```bash Claude Code theme={null}
  claude mcp add errorbar -e ERRORBAR_API_KEY=sk_... -- npx -y @error-bar/mcp
  ```

  ```json Claude Desktop / Cursor theme={null}
  {
    "mcpServers": {
      "errorbar": {
        "command": "npx",
        "args": ["-y", "@error-bar/mcp"],
        "env": { "ERRORBAR_API_KEY": "sk_..." }
      }
    }
  }
  ```

  ```bash Global install theme={null}
  npm i -g @error-bar/mcp && errorbar-mcp
  ```
</CodeGroup>

The server talks to `https://gateway.errorbar.ai` by default; `--base-url URL`
or `ERRORBAR_BASE_URL` points it elsewhere. Every environment variable also
accepts its previous `OMNIA_*` spelling.

<Note>
  The package was renamed from `@omnia-voice/mcp` on 2026-08-30. The old name is
  still published as a shim that forwards here, so existing configs keep working
  — update yours when convenient.
</Note>

## What the key can do

The server does no permission logic of its own: it sends your key and reports
what the platform says. So the key **is** the sandbox, and the useful move is
minting one that can't do more than the agent should.

A key acts as the user who minted it, and the money-spending and
traffic-redirecting operations require that user to be a workspace owner or
admin — see [key permissions and roles](/authentication#key-permissions-and-roles).
A key minted by a regular member is therefore a safe read-and-infer credential
for an agent, and it fails closed with `403` rather than silently doing less
than you asked.

Each tool's description names the permission it needs. Across the 76:

| Permission       | Tools | Covers                                                                              |
| ---------------- | ----- | ----------------------------------------------------------------------------------- |
| `read`           | 42    | Every `GET`: logs, evals, gates, evidence, clusters, criteria, aliases, jobs, audit |
| `evals:write`    | 16    | Criteria, labels, label sets, datasets, and eval lifecycle                          |
| `platform:write` | 16    | Training, dedicated capacity, batches, env tools, judge settings                    |
| `aliases:write`  | 2     | Repointing and deleting model aliases                                               |

## Keeping an agent inside the lines

Eleven tools start billable work. They say **SPENDS MONEY** in their
description and are deliberately not marked `readOnlyHint`, so any MCP client
that confirms before non-read-only calls will stop and ask:

`create_eval` · `create_batch` · `suggest_criteria` · `run_criterion_alignment` ·
`auto_improve_criterion` · `scan_criterion_suspects` · `create_dedicated_endpoint` ·
`update_dedicated_endpoint` · `create_fine_tuning_job` · `start_fine_tuning_bakeoff` ·
`start_grpo_run`

Client-side confirmation is a prompt, though, and prompts get click-through. For
a guarantee, don't expose the tools at all:

| Flag                         | Environment variable       | Effect                      |
| ---------------------------- | -------------------------- | --------------------------- |
| `--read-only`                | `ERRORBAR_MCP_READ_ONLY=1` | Expose only the `GET` tools |
| `--no-spend`                 | `ERRORBAR_MCP_NO_SPEND=1`  | Hide the eleven that bill   |
| `--only list_evals,get_eval` | —                          | Expose exactly these tools  |

```bash theme={null}
# a monitoring agent that can look at everything and change nothing
claude mcp add errorbar -e ERRORBAR_API_KEY=sk_... -- npx -y @error-bar/mcp --read-only
```

<Tip>
  Pair the two layers. `--read-only` on a member-minted key means neither the
  tool list nor the credential can spend, so a prompt-injected agent has nothing
  to escalate into. Reach for `--no-spend` when the agent genuinely needs to write
  — curating datasets, editing criteria — but should never start a run.
</Tip>

## Programmatic use

The server is a library too, so you can embed it in your own agent with the
guards already applied:

```ts theme={null}
import { createServer, ErrorbarClient } from "@error-bar/mcp";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

const server = createServer({
  client: new ErrorbarClient({ apiKey: process.env.ERRORBAR_API_KEY! }),
  readOnly: true,
});
await server.connect(new StdioServerTransport());
```

## Tool inventory

Each tool's description carries the full contract: every query and body field,
what the response contains, and the gotchas (feature flags, `400` conditions,
cursor semantics). The complete 76-row table, tool by tool with its route and
permission, is in the
[repository README](https://github.com/omnia-v/errorbar-mcp#tools).

The manifest is generated from the platform's route inventory and pinned by a
test, so a new API route fails the suite until the manifest covers it. What the
API can do, the MCP server can do.