MCP Quickstart
How an AI assistant connects to Hyphertext and makes its first tool call.
1. The endpoint
The MCP server lives at:
https://www.hyphertext.com/mcpIt speaks the MCP Streamable HTTP transport and serves standard OAuth-discovery metadata at /.well-known/oauth-protected-resource, so any MCP client that supports the OAuth flow (e.g. Claude's “Add custom connector”) can find it automatically — you shouldn't need to configure anything beyond this one URL.
2. Authenticating
There are two ways in:
OAuth (the normal path)
The client redirects the user through Supabase Auth's OAuth 2.1 Server. The user signs in (or creates a free Hyphertext account) and approves access on a consent screen at hyphertext.com/oauth/consent. The client then holds a normal Supabase user access token, which it sends as Authorization: Bearer <token> on every request. This is automatic in any MCP client that implements the OAuth 2.1 client flow.
Manual token (testing/CI)
Paste a Supabase access token for the account directly as the Authorization: Bearer header. Useful for scripting or automated testing — not the normal end-user path.
Either way, the token that reaches the server is a regular Supabase user JWT. Every tool call runs with that token, so Postgres row-level security scopes everything to that one user's data — an agent connected as one user can never see or touch another user's pages, files, or secrets.
3. Your first call
Call get_started first. It takes no arguments and returns a platform overview, the recommended build workflow, and key conventions — the same content the server also exposes as its MCP instructions field at connection time, for clients that surface that to the model.
Then, to build something minimal end to end:
get_account_status()
create_page({ title: "My page", html: "<html>...</html>", publish: true })
→ response includes publish_path — the real URL, e.g. /u/alice/p/8f2c...See Tool Reference for the complete list, or Conventions & Gotchas for the things that are easy to get wrong (there aren't many, but they matter).
What you are, in this conversation
When connected, you are acting as the builder on behalf of a signed-in Hyphertext user — not as a visitor to a page. Everything you create belongs to that user. If you're building something that will later run in front of that page's own visitors (its client-side JS, at runtime), see Runtime Endpoints — those are a different, unauthenticated surface scoped by the project's own key, not by your MCP session.