MESS
Service account inventory for developers — which email owns which Supabase, Vercel, or Stripe — kept current by your coding agents over MCP; stores metadata, never secrets.
Documentation
MCP server
Wire your agent in. One paste.
MESS is a remote MCP server. Connect it once and every coding agent you run — Claude Code, Cursor, anything that speaks MCP — logs the accounts it works with into your ledger, unprompted: created, deployed to, or found in an env file. And it checks the ledger before provisioning anything new.
Endpoint
Transport
streamable HTTP
Auth
Authorization: Bearer mess_sk_…
Keys
Free account → grab a key in Settings → Agent keys
Setup
Claude Code
One command, user scope — every project you open from then on has the ledger.
$ claude mcp add --transport http --scope user mess https://mess.fyi/api/mcp
--header "Authorization: Bearer mess_sk_YOUR_KEY"
✓ Added HTTP MCP server "mess"
Setup
Cursor
Add this to ~/.cursor/mcp.json (or a project's .cursor/mcp.json).
{ "mcpServers": { "mess": { "url": "https://mess.fyi/api/mcp", "headers": { "Authorization": "Bearer mess_sk_YOUR_KEY" } } } }
Setup
Claude.ai and everything else
Any MCP client that speaks streamable HTTP works the same way.
In Claude.ai or Claude Desktop, add a custom connector with the endpoint URL and your key as a bearer header. For any other client, point it at https://mess.fyi/api/mcp with the Authorization header set.
There is also a plain REST surface at /api/v1/accounts with the same keys, for scripts and CI.
The tools
Four tools. That's the whole surface.
The server sends instructions with the handshake, so agents know to log accounts unprompted — no per-session reminders, no custom prompts.
log_accountwrite
Log a service account the moment it is created — provider, human label, owning email, project, plan, cost, where the credentials live. Idempotent on provider + label: re-logging updates the row instead of duplicating it.
search_accountsread-only
Find accounts by free text or provider — the first call when picking a project back up, plus which email owns something and whether an account already exists before creating a new one.
list_accountsread-only
The whole ledger for this workspace, in one call.
update_accountwrite
Correct a row: record the owning email, fix a label, note where credentials live, or mark a dead account cancelled. There is no delete — history is kept.
Full disclosure
Exactly what the server tells your agent
The instructions arrive with the MCP handshake — that mechanism is the whole product, so here is the complete text, verbatim. If you'd rather your agent didn't volunteer writes, don't wire it in.
Every session — the keeping instructions
Copy
MESS is the ledger of the human's service accounts — which provider, which email owns it, which projects it serves, what it costs. Whenever you create or configure a service account (anything with a login), log it with log_account. Never store secret values in the ledger — it is the map, not the vault. The unit is one row per ACCOUNT — a login at a provider — never per project, database, or environment: a confirmed login gets one row listing everything it serves in project. Login boundaries are often unobservable (free tiers: often one account per project; different connection methods: DIFFERENT accounts) — never consolidate without a confirmed shared login; when unconfirmed, log one row per instance, "login boundary unconfirmed" in notes. A wrong merge hides an account. Before creating a new account — or provisioning any NEW service for a project — search_accounts first: reuse an existing account (or raise the choice to the human) instead of creating a parallel one; sprawl is the mess. When a row looks stale or wrong from where you stand (CLI auth state, env files, a dashboard you are in), correct it — re-logging is idempotent, corrections go through update_account. Only verify what you can actually observe; never guess. When you start or resume work on a project, search_accounts for that project as part of getting oriented — the ledger often knows accounts this machine cannot show you; raise the most important gaps at a natural moment. Unknown fields are fine — log anyway; but when a NEW account's owning email or cost is unknown while the human is present, ask them — one short question at a natural pause, never an interrogation — and record the answer with update_account. MESS tracks whatever remains as open questions for the human. There is no delete: mark dead or duplicate rows status "cancelled" with update_account. If logging hits the plan cap, keep your findings and report the unlogged accounts to the human instead of dropping them.
First connect to an empty ledger — the onboarding variant: it offers the dig, and never runs it without your say-so
Copy
MESS is the ledger of the human's service accounts — which provider, which email owns it, which projects it serves, what it costs. Whenever you create or configure a service account (anything with a login), log it with log_account. Never store secret values in the ledger — it is the map, not the vault. The unit is one row per ACCOUNT — a login at a provider — never per project, database, or environment: a confirmed login gets one row listing everything it serves in project. Login boundaries are often unobservable (free tiers: often one account per project; different connection methods: DIFFERENT accounts) — never consolidate without a confirmed shared login; when unconfirmed, log one row per instance, "login boundary unconfirmed" in notes. A wrong merge hides an account. Unknown fields are fine — log anyway; but when a NEW account's owning email or cost is unknown while the human is present, ask them — one short question at a natural pause, never an interrogation — and record the answer with update_account. MESS tracks whatever remains as open questions for the human. If logging hits the plan cap, keep your findings and report the unlogged accounts to the human instead of dropping them. …
Show the full prompt (1 more paragraphs — Copy grabs it all) ↓
The dig itself — the "sort out my mess" procedure, served whole as an MCP prompt (Claude Code: /mcp__mess__sort_out_my_mess)
Copy
Sort out my mess: inventory every service account this machine and my projects touch, and log each one to the MESS ledger. Work in three passes — first attempts routinely surface only half of what's really here, so don't declare done after one sweep. …
Show the full prompt (14 more paragraphs — Copy grabs it all) ↓
Every variant is budgeted to fit an agent's context whole — clients truncate long handshakes, so the instructions stay short and the dig procedure travels separately, as an MCP prompt your agent fetches in full only when you say “sort out my mess”. Nothing runs until you say it.
The write-moment nudge (optional hook)
If you install the optional Claude Code hook, then the moment a session runs a provider CLI (vercel, supabase, stripe, …) it asks MESS whether the ledger already knows that provider for the current repo. The matching happens on your machine — only the matched provider name and the repo folder name are ever sent, never the command itself. If the ledger already has that account for that project, the answer is silence; repeats are silenced for an hour. Otherwise your agent hears one line like this:
Example — exactly what the agent hears, composed by the same code that serves it
Copy
MESS: this session just touched the Vercel CLI in "acme-web", and the ledger has no Vercel account on record. If an account was created, configured, or found here, log it with log_account (project: "acme-web") — provider, a human label, role, the owning email if visible from where you stand. If the owning email or cost is unknown while the human is present, ask them now, one short question at a natural pause. Unknown fields are fine — log anyway.
The hook itself — what runs on your machine, verbatim
Copy
{ "hooks": { "PostToolUse": [ { "matcher": "Bash", "hooks": [ { "type": "command", "command": "m=$(head -c 20000 | grep -oiE '\b(vercel|supabase|stripe|wrangler|flyctl|netlify|railway|neonctl|turso|upstash|doctl|heroku|resend|pscale|planetscale)\b' | head -1); [ -n "$m" ] && curl -sfG --max-time 3 https://mess.fyi/api/v1/write-nudge --data-urlencode "provider=$m" --data-urlencode "project=${PWD##*/}" -H "Authorization: Bearer mess_sk_YOUR_KEY" || true" } ] } ] } }
What it never holds
The map, not the vault
MESS stores which account exists, which email owns it, and where its credentials live — never the credentials themselves. There is no field for a secret value, on purpose. A ledger row is metadata you could read aloud in a stand-up.
Writes are idempotent, rate-limited per key, and scoped to your workspace. Keys are stored hashed, revocable any time, and the whole ledger exports to deterministic markdown — no lock-in.
Free to 20 accounts. Wired in two minutes.
Start free