MCP

Every cloud release also serves an MCP endpoint at /mcp, so agents can discover and query the datasets you published. Cloud hosts the MCP server and handles authentication, so you don't run one yourself, whether you published from TypeScript or Python.

Configure a client

Print a client configuration with:

npx hypequery deployment:status --mcp-config

It looks like this:

{
  "mcpServers": {
    "hypequery": {
      "type": "http",
      "url": "https://<environment-slug>.hypequery.app/mcp",
      "headers": { "Authorization": "Bearer ${HYPEQUERY_API_KEY}" }
    }
  }
}

The key is a placeholder your MCP client expands from its environment. The CLI never writes a credential into the configuration it prints. Set HYPEQUERY_API_KEY in the client's environment or secret manager.

Sign in with OAuth

MCP clients that support OAuth can connect without an API key. The client discovers cloud's authorization server from the endpoint, and an organisation owner or admin approves it. When approving, they choose which tenants (1 to 32) the client may query, and the client's access is limited to exactly those tenants.

Tenants

Hosted MCP follows the same tenant rules as REST. A key with several permitted tenants selects one with the x-hypequery-tenant-id header. Tool arguments and chat messages cannot change the tenant a query runs as.

Check the endpoint

HYPEQUERY_API_KEY=... npx hypequery mcp --self-test --url https://<environment-slug>.hypequery.app/mcp

The self-test initializes a session and lists the available tools without calling one. A 401 means the API key was refused.

For setup in each client, the tools agents get, and what they can and cannot do, see Connect: MCP and MCP safety.