Hep.gg Documentation

MCP

Connect a model or coding agent to Hep.gg over the Model Context Protocol to read the docs and act across your apps.

Read via MCP

MCP

The Hep.gg MCP is a hosted Model Context Protocol server. Connect a model or coding agent to it once with your Hep.gg account and it can read every product doc and act across your apps on your behalf, under permissions you control. It is a Prime feature and part of the AI app.

Connecting

Connect with a browser sign-in, or with a personal token for headless use. Either way, access requires Hep.gg Prime and AI access, you can revoke it anytime from the dashboard, and every action is recorded for you to review.

Add the server with no token and your client walks you through a Hep.gg sign-in:

claude mcp add --transport http hepgg https://mcp.hep.gg

Your client opens a Hep.gg login, you approve the connection, and it is ready. This works in any MCP client that supports OAuth sign-in. If you are eligible, the connection turns itself on the first time it is used, so there is nothing to switch on first.

Use a personal token (headless or CI)

Mint a token on the dashboard and pass it as a header, which skips the browser step:

claude mcp add --transport http hepgg https://mcp.hep.gg \
  --header "Authorization: Bearer hepgg_mcp_your_token"

Permissions

You grant capability per app in three classes, so a connected model only ever gets what you allow:

Scope classes
read
optional
Safe reads: list and fetch your data.
write
optional
Create and edit content. Non-destructive and free.
dangerous
optional
Sensitive actions: sends, provisioning, deletes, and spending in-platform tokens. These always run as a two-step confirm.

There are also platform scopes for your account overview, documentation, key management, and Claude tooling setup. Real money is never spent through the MCP, only in-platform Hep Tokens, and only with your confirmation.

What a connected model can do

Read the docs
Pull any product doc and a per-app capability reference as resources, so it can research without you explaining anything.
Manage credentials
Mint, list, and rotate your API keys across apps.
Operate your apps
Uploads, status pages, docs, forms, snippets, profiles, SMS, email, storage, databases, and more, under the scopes you grant.
Wire up your tooling
Set up the Claude proxy, status line, logger, and secrets in your own project.

Reading the docs over MCP

Once connected, the model reads these as resources: a capability guide, a documentation index (hepgg://docs), every product doc (hepgg://docs/<app>/<slug>), and a per-app capability list (hepgg://capabilities/<app>) covering every action it can take. Point your agent at the MCP and it becomes an instant Hep.gg expert.

Let Claude set up your secrets

Once the MCP is connected, a Claude Code session can create and populate a Secrets project for you - useful when an agent scaffolds a service and needs somewhere safe to put the credentials it just generated or collected. Try:

Using the Hep.gg MCP, create a secrets project called "my-api" and populate it: set DATABASE_URL, REDIS_URL, and JWT_SECRET in the development environment, then mint a read-only pull token for it.

The agent walks the whole flow with the hepgg_secrets_* tools: hepgg_secrets_project_create makes a server-side encrypted project (seeded with development and production environments), hepgg_secrets_set / hepgg_secrets_bulk_set write the values, hepgg_secrets_environment_create adds more environments, and hepgg_secrets_token_mint mints a pull token so the app can fetch its config at runtime.

Notes:

  • Requires the secrets
     capability on your MCP grant (and Secrets app access). Destructive actions like deleting a project sit behind the separate dangerous-tools confirmation.
  • The MCP creates server-side encrypted projects. Zero-knowledge (E2EE) projects need key material generated in your browser, so they can only be created from the dashboard - though an agent can still write pre-encrypted ciphertext into an existing E2EE project.
  • Every write lands in the project's audit log like any other change.