Skip to content

Connect an MCP client

Varroa serves stateless Streamable HTTP MCP at https://<dashboard-host>/api/v1/mcp. Authenticate with a Varroa API key that belongs to the person or service account the client represents.

Create a credential

Section titled “Create a credential”

Create a key as described in API keys. The key uses its owner’s current Varroa and Jenkins permissions. Do not create it from an administrator account unless the client requires administrator access.

Use the stdio bridge

Section titled “Use the stdio bridge”

varroactl mcp reads MCP messages on standard input and forwards them with the credential from the active context. This keeps the key out of the MCP client configuration.

Terminal window
claude mcp add varroa -- varroactl mcp

Select a named context when needed:

Terminal window
claude mcp add varroa -- varroactl mcp --context production

Equivalent JSON configuration:

{
  "mcpServers": {
    "varroa": {
      "command": "varroactl",
      "args": ["mcp", "--context", "production"]
    }
  }
}

Use HTTP

Section titled “Use HTTP”

For a local HTTP client, start an authenticated proxy:

Terminal window
varroactl mcp serve --listen 127.0.0.1:8811 --context production

Connect the client to http://127.0.0.1:8811/. Keep the listener on loopback unless you provide separate transport security and access controls.

A client can also connect directly:

POST /api/v1/mcp HTTP/1.1
Host: app.example.com
Authorization: Bearer vk_<prefix>.<secret>
Content-Type: application/json

Inject the key from a secret store. Do not save it in a shared client configuration file.

Verify access

Section titled “Verify access”

Call get_me to confirm the resolved identity, then call get_my_permissions with an optional namespace and controller name. An empty permission result means authentication succeeded but the owner has no matching role grant.

Use Varroa RBAC for control-plane access and Jenkins RBAC for controller operations.

Section titled “Related pages”