Connect

Connect an AI agent

This is about connecting an AI coding agent to the Aaly platform itself — so it can define entities and fields through MCP tools. For your app's own end-user login, see Auth.

Easiest path: ask your agent to do it. Paste this into Claude Code, Cursor, Codex, or any coding agent:

Read https://aaly.io/connect.md and connect yourself to Aaly.

That file walks the agent through adding the server for whichever client it's running in; you only approve the consent screen.

Claude (web, Desktop, mobile): use the connector directory

Aaly is listed in Claude's connector directory. Search Aaly under Settings → Connectors (or the tools menu in a chat), click Connect, and approve the consent screen that opens in your browser. There is no URL to paste and nothing to configure by hand.

Once it's connected, paste this:

You're connected to Aaly. Ask me what app I want. Then: Aaly builds the backend (data + live API); you build a simple frontend that uses that API — so I end up with a full-stack app, not just a schema.

Start by asking for my idea (or suggest helpdesk / booking / billing if I'm stuck). After the backend is ready, give me the API link, how to sign up, and a small working frontend. Say clearly if something can't be done yet.

Claude reaches for Aaly's MCP tools on its own from there.

Cursor, Codex, or manual setup

Add this URL as a custom MCP connector:

https://mcp.aaly.io

That's the whole configuration. Approving the consent screen that opens in your browser completes the rest — this is the same OAuth flow the Claude connector directory runs for you automatically:

  1. Your agent requests the server and gets a 401 with a WWW-Authenticate: Bearer resource_metadata=... challenge (RFC 9728).
  2. It fetches /.well-known/oauth-authorization-server (RFC 8414) to discover the authorization and token endpoints.
  3. It registers itself dynamically via the registration_endpoint (RFC 7591) — nothing to pre-provision in a dashboard.
  4. It runs an OAuth 2.1 authorization-code flow with PKCE (S256), opening the consent screen in your browser.
  5. It holds a scoped, revocable token. No key is ever shown to you or pasted by you.

Verified against the live server:

$ curl -i https://mcp.aaly.io
HTTP/1.1 401 Unauthorized
www-authenticate: Bearer resource_metadata="https://mcp.aaly.io/.well-known/oauth-protected-resource"

Tested end to end against Claude and Codex.

Revoking access

Revoke a connected agent's token from the dashboard at any time — it's scoped per agent, so revoking one doesn't affect any other connector or any API key you've issued separately.

API key (advanced)

For CI, scripts, server-side integrations, and any client that can't open a browser. Generate a key in the dashboard, or via POST /auth/keys on your project's REST API (see Auth for the exact request), then configure your MCP client with it directly:

{
  "mcpServers": {
    "aaly": {
      "type": "http",
      "url": "https://mcp.aaly.io",
      "headers": { "Authorization": "Bearer aaly_<id>_<secret>" }
    }
  }
}

Same server, same tools, same tenant scoping as the OAuth path — you just manage the credential yourself. Revoke it with DELETE /auth/keys/{id} or from the dashboard.

What your agent can do once connected

Every MCP tool call operates on your project's definition — entities, fields, and schema inspection — never on your app's end-user data directly. Full list: MCP tools reference.