This page gives client-specific setup for PubFi’s hosted MCP endpoint. It covers the API-key execution lane. Use MCP Client Setup for the protocol, tool, and x402 contracts. The Production examples use:
For Staging, replace the endpoint with https://mcp-stg.pubfi.ai and replace PROD_PUBFI_API_KEY with STG_PUBFI_API_KEY. Do not mix endpoints and keys.

Before You Start

  1. Create a PubFi key from the selected environment’s dashboard as described in API Key And Runtime. The server assigns the key environment.
  2. Store the key in a secret manager, a client secure-input store, or an environment variable:
  3. Keep the key out of prompts, source control, shared client configuration, screenshots, and logs.
  4. Use the exact hosted MCP root. Do not append /mcp, /sse, or another path.
PROD_PUBFI_API_KEY is a local variable name for the client key issued to your account. It is not a shared PubFi Production key and it is not a server-side hashing secret. Each user or agent owner must supply and rotate their own issued key. Public handshake, tool discovery, and capability reads work without a key. An API-key call to pubfi.route.execute needs the configured header.

What The Agent Will See

Every unrestricted client connection discovers the same three generic tools:
  • pubfi.capabilities.list
  • pubfi.capabilities.get
  • pubfi.route.execute
Subscan and DeGov are provider filters and Registry data. They are not separate MCP tool names. The agent must:
  1. call pubfi.capabilities.list with exact provider_key: "subscan" or provider_key: "degov";
  2. select one current capability and call pubfi.capabilities.get with its exact capability_id; and
  3. execute only the returned exact raw_path and method.
A client that reports no subscan.* or degov.* tools is working as designed.

Client Coverage

Use an environment or secure-input reference when the client supports one. Some clients only document static custom headers. For those clients, put the key only in the private user-level configuration, disable settings sync for that entry, and never use a project or team file. Rotate the key if that file is copied, logged, or shared. The general clients on this page do not become x402 wallet clients by adding an MCP server. Use an x402-aware client and Accountless x402 for accountless payment.

Codex CLI, Codex IDE, And ChatGPT Desktop

Codex CLI, the Codex IDE extension, and the ChatGPT desktop app share ~/.codex/config.toml on the same Codex host. Add:
Start the client from an environment that contains PROD_PUBFI_API_KEY. Then:
  • run codex mcp list in a terminal;
  • use /mcp in the Codex terminal UI or ChatGPT desktop composer; or
  • open MCP servers in the IDE extension and restart the extension.
See the official Codex MCP guide.

Claude Code

Add this entry to a project .mcp.json or the equivalent user-level configuration:
Claude Code expands environment variables in HTTP headers. Run claude mcp list, then use /mcp in Claude Code to check the connection. A project .mcp.json can be shared because the example contains only an environment-variable reference, not the key. See the official Claude Code MCP guide.

VS Code With GitHub Copilot

Open the user MCP configuration with MCP: Open User Configuration, or create .vscode/mcp.json. Use a secure input:
VS Code prompts once and stores the input securely. Run MCP: List Servers, start pubfi, and review the tool list. A VS Code MCP file uses the top-level servers key, not mcpServers. See the official VS Code MCP configuration reference.

GitHub Copilot CLI

Add this entry to the private user file ~/.copilot/mcp-config.json:
Copilot CLI expands environment variables in remote headers. Do not put the key in a shared .mcp.json or .github/mcp.json file. Run copilot mcp list and copilot mcp get pubfi, or use /mcp show pubfi in an interactive session. Copilot CLI does not read VS Code’s .vscode/mcp.json; the top-level keys are different. See the official GitHub Copilot CLI MCP guide and CLI command reference.

GitHub Copilot Coding Agent

Repository administrators can configure PubFi at Settings → Copilot → MCP servers. Create an Agents secret named COPILOT_MCP_PUBFI_API_KEY, then start with this read-only configuration:
GitHub requires MCP secret and variable names to start with COPILOT_MCP_. The coding agent can call enabled tools without an approval prompt. Add pubfi.route.execute to tools only after the repository owner has reviewed PubFi account permissions, cost, and the routes that the agent may execute. Never put the key value in the JSON. See the official Copilot coding agent MCP guide.

Cursor IDE And Cursor Agent

Add this entry to the user file ~/.cursor/mcp.json or a project .cursor/mcp.json:
Cursor resolves ${env:...} when it starts. Make sure the Cursor process receives the environment variable, then restart Cursor. For Cursor Agent, run:
Cursor does not use VS Code’s inputs array in mcp.json. See the official Cursor MCP guide and Agent CLI reference, plus Cursor’s current secret handling guidance.

Devin CLI And Devin Local

Use the gitignored local file .devin/mcp_config.local.json for a project-specific key, or the user file ~/.config/devin/mcp_config.json:
Run:
Do not put the key value in .devin/mcp_config.json, because that project file is designed for source control. See the official Devin MCP configuration guide.

Windsurf Legacy Cascade

New Devin Desktop tabs use Devin Local and its configuration above. The following file applies only to the legacy Cascade agent:
Add:
Legacy Cascade also supports ${file:/absolute/path} interpolation. Use a protected secret file if the desktop process does not receive shell environment variables. See the official Cascade MCP guide.

Gemini CLI

Gemini CLI uses ~/.gemini/settings.json for user scope and .gemini/settings.json for project scope. Its documented HTTP-header form uses a static value, so put this entry only in the private user file:
Replace the placeholder locally. Do not commit or share the resulting file. Run gemini mcp list to check the connection. Use httpUrl for Streamable HTTP; url selects the legacy SSE transport. If local policy forbids a static header, use the stdio bridge instead. Gemini can expand an environment variable in a stdio server’s env map. See the official Gemini CLI MCP guide.

Kiro IDE And Kiro CLI

Open .kiro/settings/mcp.json for workspace scope or ~/.kiro/settings/mcp.json for user scope:
Kiro expands the environment variable and reconnects when you save the file. Use /mcp in an interactive Kiro CLI session or the IDE MCP panel to inspect the server. See the official Kiro IDE and CLI configuration guides.

Amazon Q Developer IDE And CLI

For the IDE, open the Amazon Q Developer panel, select Chat, select the tools icon, and add an MCP server. Use:
  • Scope: Global
  • Name: pubfi
  • Transport: http
  • URL: https://mcp.pubfi.ai
  • Header name: Authorization
  • Header value: Bearer <Production PubFi API key>
Global scope keeps the static header out of the project. Protect ~/.aws/amazonq/default.json, do not sync or share it, and leave tool permissions on Ask for the first connection. If Amazon Q starts an OAuth flow, remove the direct entry and use the bridge below. The current Amazon Q Developer CLI documentation describes open or OAuth-authenticated remote MCP servers, but it does not describe an arbitrary static header for them. Use the stdio bridge for the PubFi API-key lane. Add the generic stdio entry to the private global agent configuration, then run qchat mcp list and qchat mcp status to inspect it. Do not configure the Production endpoint as an unauthenticated remote server. See the official Amazon Q Developer IDE MCP guide and CLI MCP guide.

Continue

Create .continue/mcpServers/pubfi.yaml:
Store PROD_PUBFI_API_KEY in ~/.continue/.env, a private workspace .env, or the Continue secret facility. Do not commit the .env file. MCP tools are available in Continue Agent mode. See the official Continue MCP guide and local secret guide.

Cline IDE And CLI

For Cline CLI, edit ~/.cline/mcp.json. In the IDE, open MCP Servers and then Configure MCP Servers. Use a user-level file, not a project file:
Replace the placeholder only in the private local file. Keep autoApprove empty until you have reviewed the three tools. Cline’s Remote Servers tab can create the same Streamable HTTP entry. See the official Cline MCP guide.

Roo Code

Open Roo Code’s MCP settings and select Edit Global MCP. Do not use the project .roo/mcp.json file for a static key:
Replace the placeholder in the private global file. Leave alwaysAllow empty for the first connection. See the official Roo Code MCP guide.

Zed

Open Settings → AI → MCP Servers → Add Server → Add Remote Server. Enter:
  • URL: https://mcp.pubfi.ai
  • Header name: Authorization
  • Header value: Bearer <Production PubFi API key>
Zed writes a context_servers entry to the user settings file. Keep that setting private and do not sync or share the static header. A green status indicator means that the server is active. See the official Zed MCP guide.

Raycast AI

Run Install MCP Server and select the HTTP transport. Enter:
  • URL: https://mcp.pubfi.ai
  • HTTP header name: Authorization
  • HTTP header value: Bearer <Production PubFi API key>
Raycast starts the connection and loads the tools. Use Manage MCP Servers to review status and the tool list. Keep the header private. Do not paste it into a shared Raycast export. See the official Raycast MCP guide.

LM Studio

Open the Program panel, select Install → Edit mcp.json, and add:
Replace the placeholder only in LM Studio’s private local file. Do not publish or share the resulting mcp.json. Enable pubfi in the Program panel and use a model that supports tool calls. For server-side LM Studio integrations, custom headers are also supported on an ephemeral MCP entry, but the key must remain in the caller’s secret store. See the official LM Studio MCP host guide and MCP API guide.

OpenCode

Add this entry to the user configuration, normally ~/.config/opencode/opencode.json:
oauth: false prevents an unrelated OAuth attempt on the current PubFi API-key lane. Run opencode mcp list to check the connection. If needed, run opencode mcp debug pubfi to inspect the transport without copying the key into a prompt. See the official OpenCode MCP guide.

Warp Local Agents

Open Settings → Agents → MCP servers, add a Streamable HTTP or SSE Server (URL), and enter:
  • URL: https://mcp.pubfi.ai
  • Header name: Authorization
  • Header value: Bearer <Production PubFi API key>
Keep the server under Personal and do not share it with a team. Warp documents custom headers for remote MCP servers, but it does not document environment expansion in remote header values. Use the stdio bridge if local policy forbids a static value. After the server starts, review its three tools and keep MCP auto-approval disabled until you have reviewed execution behavior. See the official Warp MCP guide.

LibreChat

Open MCP Settings in the right sidebar, select +, and enter:
  • Name: pubfi
  • URL: https://mcp.pubfi.ai
  • Transport: Streamable HTTP
  • Authentication: API Key
  • Key source: User provides key
  • Header format: Bearer
Each user must enter their own Production PubFi client key when LibreChat asks for the API key. Do not put a shared PubFi key in librechat.yaml. An administrator can share the server definition, but must not store a user’s key in that definition. In the Agent Builder, enable the two discovery tools first and add pubfi.route.execute only when the agent must execute routes. See the official LibreChat MCP guide and server configuration reference.

Clients That Need The Stdio Bridge

The checked-in bridge is for clients that launch a local MCP command or do not document a safe custom HTTP-header configuration. It forwards to PubFi’s hosted MCP endpoint. It does not run a second PubFi backend. Clone the PubFi Docs repository, install a supported Node.js runtime, and use the absolute path to:
The bridge reads PROD_PUBFI_API_KEY or STG_PUBFI_API_KEY from its process environment. It also accepts only the exact Production or Staging MCP root.

Generic Stdio Entry

Replace /absolute/path/to/pubfi-docs with the checkout path:
This example contains a placeholder. Put the real value only in a private user-level client file. If the client can inherit environment variables, omit PROD_PUBFI_API_KEY from the env map and start the client from a secret-injected environment instead.

Claude Desktop

Open:
  • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
  • Windows: %APPDATA%\Claude\claude_desktop_config.json
Add the generic stdio entry, save the file, and fully restart Claude Desktop. Use absolute paths. See the official local MCP server guide.

JetBrains AI Assistant

Open Settings → Tools → AI Assistant → Model Context Protocol (MCP), add an STDIO server, and paste:
Start the IDE from an environment that supplies PROD_PUBFI_API_KEY and PUBFI_MCP_ENDPOINT=https://mcp.pubfi.ai. JetBrains documents remote Streamable HTTP, but its current AI Assistant guide does not document custom remote headers. The bridge keeps the key out of the JetBrains JSON entry. See the official JetBrains AI Assistant MCP guide.

goose Desktop And CLI

Run goose configure, select Add Extension, and add a local STDIO extension. You can also add this private user configuration under extensions in ~/.config/goose/config.yaml:
Supply PROD_PUBFI_API_KEY through the process environment or goose’s supported secret storage. Do not put the key in config.yaml. Restart goose after a direct config edit, then run goose info -v to verify that pubfi is enabled. See the official goose configuration guide and custom extension guide.

Cherry Studio

Open Settings → MCP Server → Add Server and enter:
  • Name: pubfi
  • Type: STDIO
  • Command: node, or the absolute path to the Node.js executable
  • Arguments: the absolute path to examples/agents/pubfi-route-tools-mcp/server.mjs
Supply PUBFI_MCP_ENDPOINT=https://mcp.pubfi.ai and PROD_PUBFI_API_KEY through the private per-user server environment or start Cherry Studio from a secret-injected environment. Do not put the key in a shared export. Save the server, enable it in the chat box, and use a model that supports tool calls. See the official Cherry Studio MCP configuration guide.

Gemini CLI With The Bridge

Use this user-level settings.json entry when local policy forbids a static HTTP header:
Gemini expands the parent environment variable in the stdio env map.

Other MCP Clients

For another client, first confirm in its current official documentation that it supports one of these connection forms:
  • Streamable HTTP with custom headers: use the exact PubFi environment root and an Authorization: Bearer ... header. Use the client’s secret or environment reference if it has one. Otherwise keep the header only in a private, unsynced user setting.
  • Local STDIO command: use the checked-in bridge and inject the matching key into the bridge process environment.
  • Remote URL without custom headers: public discovery can work, but authenticated execution through the current API-key lane is not established.
  • OAuth-only hosted connector: do not assume compatibility. Use a local client or wait for a documented PubFi-compatible hosted authentication flow.
Always verify the three generic PubFi tools before you allow execution. A client that requires a provider-specific subscan.* or degov.* tool shape is not compatible with PubFi’s current generic route interface.

Hosted Web Client Boundaries

ChatGPT Web

ChatGPT web does not read local Codex MCP configuration. Current ChatGPT custom apps connect to a remote MCP server from OpenAI infrastructure. The current official app guide documents OAuth but does not document a user-supplied static bearer header for every request. PubFi’s anonymous handshake and capability tools can be scanned without a key, but this guide does not claim that ChatGPT web can execute the current PubFi API-key lane. Use Codex CLI, the Codex IDE extension, or ChatGPT desktop until PubFi exposes a compatible hosted auth flow or OpenAI documents a static-key mechanism for custom apps. See the official ChatGPT developer mode and MCP app guide.

Claude Web And Cloud Custom Connectors

Claude custom connectors run from Anthropic infrastructure. The current connector UI documents a remote URL and optional OAuth client credentials. It does not document an arbitrary static bearer header. The public capability tools can connect without a key, but this guide does not claim authenticated pubfi.route.execute compatibility through a Claude cloud connector. Use Claude Code or the Claude Desktop local stdio bridge for the current API-key lane. See the official Claude custom connector guide.

Verify Discovery Without Spending A Request

After the client reports that pubfi is connected, ask:
Repeat with provider_key "subscan". This verifies the generic list and detail flow. Capability reads do not consume an account execution request. Do not ask the model to invent a path from a provider name. Do not continue if the detail is blocked or if it belongs to a different Registry generation.

Verify One Controlled Execution

First ask the agent to plan and wait:
Review the selected route. If you approve one account request, reply:
The live Registry may have no matching no-input route. That is not a client failure. Select another current ready capability and supply its exact required input, or stop.

Troubleshooting

The Client Shows No PubFi Server

  • Use the exact environment root.
  • Select Streamable HTTP, not legacy SSE.
  • Restart or reload the client after a configuration change.
  • Approve or trust the server when the client asks.
  • For the bridge, use an absolute script path and a supported node executable.

The Server Connects But Execution Returns An Auth Error

  • Confirm that the client process can read the selected environment variable.
  • Confirm that the header begins with Bearer and contains a key created by the matching environment’s dashboard.
  • Do not send a Staging key to Production or a Production key to Staging.
  • Configure Authorization: Bearer <PubFi API key>. X-PubFi-Api-Key is not accepted.
  • Rotate the key if it appeared in a prompt, log, shared file, or settings sync.

The Agent Looks For subscan.* Or degov.*

Tell it to use pubfi.capabilities.list with the exact provider_key, then get the selected capability detail. Provider-specific public MCP tools do not exist.

A Saved Route Is Now Blocked Or Missing

Start again from pubfi.capabilities.list. Cursors, readiness, capability ids, and route contracts belong to the installed Registry generation. Do not execute a saved route from an older generation.

The Client Starts An OAuth Flow

PubFi’s current documented account lane uses an API key in a request header. Configure the custom header or use the stdio bridge. Do not complete an unrelated OAuth flow and assume it authorizes PubFi execution.

The Tool Returns An x402 Challenge

The request did not use a valid PubFi API key, or you intentionally selected accountless payment. A general MCP client cannot pay unless it implements the official x402 MCP metadata flow and has a separately managed wallet. Fix the API-key transport or continue with Accountless x402. For current tool schemas and execution rules, continue to the Agent Interface Reference.