MCP Integration Guide

Every app you create on Web-Nothing is automatically accessible to AI agents via the Model Context Protocol (MCP). Any MCP-compatible agent -- Claude, ChatGPT, or custom agents -- can connect and start working with your app's data in minutes.

For a quick 5-minute setup, see the MCP Quick Start.

Note: Per-App MCP requires your app to be in Live mode. Click Go Live in your workspace toolbar. Apps in Dev mode get a 30-day MCP trial; apps in Live mode get permanent MCP access.

Two MCP Levels

Web-Nothing exposes MCP at two endpoints:

Token to endpoint compatibility:

• An App Token works only on the per-app endpoint for the single app it was minted for.
• A Platform Token works on both endpoints — platform-level operations, and the per-app endpoint of any app you own. A single Platform Token is enough for an agent that needs to build an app and then read/write its data.

When to use which:

• Use Per-App MCP for focused agents that only need to operate on one app's data.
• Use Platform MCP for orchestration agents that create apps, install templates, build workflows, or need to work across multiple apps.

Token Management

Agent tokens follow a create-once, copy-once lifecycle. The raw token is shown exactly once at creation and is never retrievable again.

Create a Token

1. Open your app in the workspace.
2. Click Agent ON to enable agent access.
3. Click MCP in the toolbar.
4. Choose one of:
   • + App Token (blue) — scope is bound to this single app. Default allowedActions: ['*'] (all data actions).
   • + Platform Token (purple) — scope covers all your apps, templates, workflows, and connectors. Default allowedActions: ['*'].
5. Optional: tick Allow schema edits (advanced) before clicking if you want the agent to be able to add or remove tables, fields, actions, or UI components in this app. Off by default.

Or via API:

POST /api/apps/{appId}/agent-tokens
Content-Type: application/json

{
  "name": "My Agent",
  "scope": "APP",
  "allowedActions": ["*"],
  "expiresInDays": 30
}

To create a token with schema-edit permission, request the advanced permission string:

{
  "name": "Schema Admin",
  "scope": "APP",
  "allowedActions": ["*", "spec:*"],
  "expiresInDays": 30
}

This matches the Allow schema edits option in the UI.

Response (201):

{
  "id": "clxyz123...",
  "token": "wn_a1b2c3d4e5f6...64hex",
  "name": "My Agent",
  "scope": "APP",
  "expiresAt": "2026-04-16T12:00:00.000Z"
}

Copy the token value immediately. It will never be shown again.

Token Parameters

Action scoping rules:

• "*" — covers all standard data actions (createRecord, updateRecord, deleteRecord, listRecords, getRecord, cloneRecord, multiRecord). multiRecord creates one parent + N children atomically in a single transaction (cart submits, invoices with line items, batch RSVP); partial failure rolls back the whole batch.
• "*" does not cover apiCall actions (these forward to external APIs). To allow one, add its action ID to allowedActions, e.g. ["*", "send_email"].
• "*" does not cover schema-edit permission. Add "spec:*" if you want the agent to be able to modify the app's structure — this is the same capability as the Allow schema edits checkbox in the UI.

You can create multiple tokens per app (up to 10), each with different permissions.

Use the Token

Include it as a Bearer token in all MCP requests:

Authorization: Bearer wn_a1b2c3d4e5f6...64hex

Revoke a Token

DELETE /api/apps/{appId}/agent-tokens
Content-Type: application/json

{ "tokenId": "clxyz123..." }

List Tokens

GET /api/apps/{appId}/agent-tokens

Returns all tokens for the app (without the raw token value) including lastUsedAt timestamps.

Per-App MCP Tools

Every app with agent access enabled automatically generates MCP tools based on its data tables and actions. No manual configuration needed.

Tool Naming

Tools are named {app_name}_{action}, where the app name is lowercased with special characters replaced by underscores.

Example: An app named "Task Tracker" with actions add_task, list_tasks, delete_task generates:

• task_tracker_add_task
• task_tracker_list_tasks
• task_tracker_delete_task

Discovery (GET)

curl -s https://web-nothing.vercel.app/api/apps/{appId}/mcp \
  -H "Authorization: Bearer wn_your_token" | jq '.result.tools[].name'

Returns the full tool listing with names, descriptions, and input schemas.

Execution (POST)

{
  "method": "tools/call",
  "params": {
    "name": "task_tracker_add_task",
    "arguments": {
      "title": "Buy groceries",
      "priority": "high",
      "done": false
    }
  }
}

Response:

{
  "jsonrpc": "2.0",
  "result": {
    "content": [{
      "type": "text",
      "text": "{\"id\":\"rec_abc123\",\"title\":\"Buy groceries\",\"priority\":\"high\",\"done\":false,\"created_at\":\"2026-03-17T10:00:00.000Z\"}"
    }]
  }
}

The text field contains a JSON string. Parse it to get the actual data.

Supported Methods

Schema-Edit Permission (advanced, opt-in)

When a token is granted schema-edit permission (via the Allow schema edits checkbox in the UI, or "spec:*" in allowedActions), the tools/list response includes additional tools that let the agent:

• Add or remove data tables
• Add, rename, or remove fields inside a table
• Add or remove UI components
• Add or update app actions
• Read the app's current structure

Tokens without schema-edit permission do not see these tools at all. The tools only affect the app the token is scoped to — they cannot touch other users' apps or the Web-Nothing platform itself.

Schema edits are a powerful capability — grant this permission only to agents you trust to change your app's structure. For day-to-day data operations, the default (data-only) permission is safer.

Platform MCP Tools

The platform endpoint exposes tools for managing your entire workspace programmatically.

Endpoint

GET  /api/mcp   — Tool discovery (requires PLATFORM-scoped token)
POST /api/mcp   — Tool execution

App Management

Template Management

Workflow Management

Connector Management

AI-Readable Documentation

Every agent-enabled app auto-generates documentation that AI agents can consume.

Plain Text (llms.txt)

GET /api/apps/{appId}/llms

Returns a plain-text Markdown document containing:

• App name and description
• MCP endpoint URL and authentication instructions
• Complete tool listing with parameters, types, and required flags
• Data table definitions with field types
• Ready-to-use example requests

This endpoint requires no authentication and is designed to be publicly discoverable so agents can learn about the app before obtaining a token.

Interactive HTML Docs

GET /api/apps/{appId}/docs

Returns a styled HTML documentation page with the same information, useful for human developers integrating with the MCP endpoint.

Connecting MCP Clients

Claude Desktop / Claude Code

Per-App connection:

{
  "mcpServers": {
    "my-task-tracker": {
      "url": "https://web-nothing.vercel.app/api/apps/{appId}/mcp",
      "transport": "http",
      "headers": {
        "Authorization": "Bearer wn_your_token_here"
      }
    }
  }
}

Platform connection:

{
  "mcpServers": {
    "web-nothing-platform": {
      "url": "https://web-nothing.vercel.app/api/mcp",
      "transport": "http",
      "headers": {
        "Authorization": "Bearer wn_your_platform_token_here"
      }
    }
  }
}

For Claude Code, you can also use the CLI:

claude mcp add web-nothing \
  --transport http \
  https://web-nothing.vercel.app/api/apps/{appId}/mcp \
  -- --header "Authorization: Bearer wn_your_token_here"

ChatGPT (Custom GPT with Actions)

1. In ChatGPT, create or edit a Custom GPT.
2. Under Actions, add a new action pointing to the MCP endpoint:

{
  "openapi": "3.1.0",
  "info": { "title": "Web-Nothing MCP", "version": "1.0.0" },
  "servers": [{ "url": "https://web-nothing.vercel.app" }],
  "paths": {
    "/api/apps/{appId}/mcp": {
      "post": {
        "operationId": "callMCPTool",
        "summary": "Execute an MCP tool call",
        "parameters": [
          { "name": "appId", "in": "path", "required": true, "schema": { "type": "string" } }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "method": { "type": "string", "enum": ["tools/call", "tools/list"] },
                  "params": {
                    "type": "object",
                    "properties": {
                      "name": { "type": "string" },
                      "arguments": { "type": "object" }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

3. Set Authentication to "API Key" with header Authorization and value Bearer wn_your_token_here.

Any HTTP Client

Any agent or automation tool that can make HTTP requests can use the MCP endpoints directly:

# Discover tools
curl -s https://web-nothing.vercel.app/api/apps/{appId}/mcp \
  -H "Authorization: Bearer wn_your_token" | jq .

# Execute a tool
curl -s -X POST https://web-nothing.vercel.app/api/apps/{appId}/mcp \
  -H "Authorization: Bearer wn_your_token" \
  -H "Content-Type: application/json" \
  -d '{
    "method": "tools/call",
    "params": {
      "name": "task_tracker_list_tasks",
      "arguments": { "limit": 5 }
    }
  }' | jq '.result.content[0].text | fromjson'

Security

Token Scopes

Security Features

• Encrypted storage -- tokens are stored as SHA-256 hashes; raw values are never persisted
• Scoped access -- APP tokens cannot access other apps; PLATFORM tokens are limited to the user's own workspace
• Audit logging -- every tool call is recorded with the token used, action executed, parameters, result, and duration
• Expiration -- tokens expire after 1-365 days (default 30)
• Credential protection -- API connector credentials and sensitive operations require explicit token permissions (not covered by wildcards)
• Rate limiting -- per-app and per-token rate limits prevent abuse

Agent Build Strategies

Web-Nothing offers three ways to create an app via MCP. They differ in how much Web-Nothing AI inference they use — which directly affects your monthly prompt quota.

Strategy A: Install a template (cheapest)

Best when an existing template covers what you need. No Web-Nothing AI is called.

1. List community templates with templates_list to find a match.
2. Install with templates_install — the app is created with seed data.
3. Customize on the per-app endpoint: add or rename fields with the schema-edit tools (requires the Allow schema edits permission), then create or update records as usual.

Strategy B: Build the structure yourself (recommended for autonomous agents)

Best when you want to control the exact shape of the app. No Web-Nothing AI is called — your agent does the reasoning on its own side, and Web-Nothing just validates the structure and stores it.

1. Construct the app structure (tables, fields, actions, layout) in your agent.
2. Submit it to apps_create_from_spec — if the structure is valid, the app is created on the spot. If not, you get a detailed list of issues to fix and retry.
3. Iterate with the schema-edit tools on the per-app endpoint, or just populate data with the standard CRUD tools.

Three ways to learn the structure shape:

• Component reference: see the Component Catalog for the exact type strings and props your spec can include — name mismatches cause silent drops at render time.
• Inspect a template: install one with templates_install, then call apps_get_tools to see what tools (and therefore what fields and actions) it exposes.
• Read an existing app: call the schema-edit tools on any app you already have and use the "read current structure" tool to see a working example.

Strategy C: One-shot from a prompt (uses Web-Nothing AI)

Best for the first-time bootstrap when you don't have a template or structure in mind. Consumes one prompt from your monthly quota.

apps_create({ prompt: "Build me a CRM with deals, contacts, and tasks" })

After the bootstrap, switch to Strategy B to iterate — keep your prompt quota for cases where you actually need natural-language generation.

Summary — which tools use Web-Nothing AI:

Limits & Quotas

Web-Nothing enforces fair-use limits across all tiers, including paid plans. These caps protect platform stability while leaving plenty of room for normal usage — existing apps average well under every cap.

Per-app structural limits (all tiers)

Records per data table (tiered)

Attempts to grow a table beyond its cap return 413 with a clear message. Updates and deletes are still allowed even if an existing table exceeds the cap (e.g. after a downgrade), so you never lose access to your own data.

Rate limits (per agent token)

Per-minute and per-token limits are flat across tiers — they're burst protection, not feature gates. The daily cap scales with your subscription tier.

Exceeding a rate limit returns 429 with Retry-After.

Related