Connecting Claude Code¶
Claude Code reads MCP servers from three scopes: local (the default of
claude mcp add, stored for the current project), project (a .mcp.json in
the repository) and user (all your projects). mcprack generates a dedicated
format for it, claude-code, that contains no secret.
The generated file¶
{
"mcpServers": {
"zabbix": {
"type": "http",
"url": "https://mcprack.example.com/proxy/mcp/8",
"headers": { "Authorization": "Bearer ${MCPRACK_TOKEN}" }
}
}
}
The URL is the plain relay route; the credential is read by Claude Code from the
MCPRACK_TOKEN environment variable (${VAR} is expanded in url and
headers). So the file can be committed as .mcp.json. The variable has our
own name on purpose: Claude Code reads credential-looking variables such as
ANTHROPIC_API_KEY or NPM_TOKEN as empty inside the headers of a remote
server.
Step by step¶
Create a token with the scope
proxy:access(user menu → API tokens, orPOST /api/v1/tokens). It expires after 90 days unless you choose otherwise.Export it where Claude Code starts — a shell profile, direnv, a secret manager; not the repository:
export MCPRACK_TOKEN=mcr_...Add the servers, either by saving the download as
.mcp.json(project scope; Claude Code asks each person to approve a project server once), or with the commands from the View & Copy page:claude mcp add --transport http --scope user zabbix \ https://mcprack.example.com/proxy/mcp/8 \ --header "Authorization: Bearer $MCPRACK_TOKEN"
In Claude Code run
/mcpto see the status of each server.
With OAuth enabled¶
When OAUTH_ENABLED=true the generated file has no headers: Claude Code
runs the sign-in itself (/mcp → authenticate, or claude mcp login). Ask for
the header anyway with ?auth=token. See Enabling MCP OAuth.
Verify before users try it¶
sudo mcprack user config verify alice claude-code
If a server shows failed¶
MCPRACK_TOKEN=mcr_... mcprack-mcp-probe --bearer --tools \
https://mcprack.example.com/proxy/mcp/8
The probe shows at which step the connection breaks. Common causes are in Troubleshooting.