Pinafly UAT MCP

npx add-mcp 'https://pinafly.com/mcp/uat'

What your agent can do with it

• Write a review for you to walk

  A draft review: the pages of your running app to check, each with numbered steps and what you should see.

• Read the review back

  See its pages and guides, whether it has been sent, and how many comments are waiting, including any locked by your plan's limit.

• Read your comments

  Each comment says which page and which element it is on, and what you wrote, including replies.

• Say it fixed something

  It reports the fix and what changed. You look at it and mark the comment resolved.

• Say it will not change something

  It gives its reason, such as intended behaviour or out of scope, and you decide.

• Hear how your walk ended

  When you finish a walk it reads your answer, Pass or Needs rework, and your note.

How it works

1. 1. Connect Add https://pinafly.com/mcp/uat to your agent and press Allow when your browser opens. There is no key to copy.
2. 2. Walk The agent gives you a link. You open each page in your real app, turn on Comment, and click what is wrong.
3. 3. Fix Tell the agent to fix the Pinafly feedback. It reads your comments, fixes them and reports back, and you resolve what is done.

Connect your agent

Every agent uses the same address and the same browser sign-in. Claude Code is tested end to end. If another agent asks for a client ID or cannot open a browser, use a token as described in the setup guide.

Agent	Add it	Then
Claude Code	claude mcp add --transport http pinafly-uat https://pinafly.com/mcp/uat Copy	Type /mcp, choose pinafly-uat, then Authenticate
Codex	codex mcp add pinafly-uat --url https://pinafly.com/mcp/uat Copy	codex mcp login pinafly-uat
Cursor	{"mcpServers": {"pinafly-uat": {"url": "https://pinafly.com/mcp/uat"}}} Copy	Put it in.cursor/mcp.json, then connect pinafly-uat in Cursor's MCP settings
Gemini CLI	gemini mcp add --transport http pinafly-uat https://pinafly.com/mcp/uat Copy	Type /mcp auth
GitHub Copilot in VS Code	{"servers": {"pinafly-uat": {"type": "http", "url": "https://pinafly.com/mcp/uat"}}} Copy	Put it in.vscode/mcp.json, start the server, then sign in when VS Code asks

What it cannot do

Your agent cannot send a review to anyone, invite anyone, mark a comment resolved, or allow your app's address on its own. A person does each of those, so a mistaken or misled agent cannot act for you.

Security in plain words

• You approve each agent in your browser, and it works only inside the workspace you chose.
• Pinafly shows a token once and keeps only a fingerprint. You can revoke it on your Live review page.
• Words from reviewers outside your team are held until you release them, so they never reach your agent.
• Comments that reach your agent are labelled as typed text to evaluate, never as instructions to follow.
• Pinafly runs no AI model on your code. The one optional exception, suggestions on a review's comments, is in the privacy policy and a workspace can turn it off.

Questions

What is the Pinafly MCP server?

It is a connection that lets a coding agent such as Claude Code, Codex or Cursor hand you a list of pages in your running app to check, each with steps and what you should see. You walk the pages, comment on anything wrong, and the agent reads your comments and fixes them.

Which coding agents work with it?

Any agent that speaks MCP over HTTP. Claude Code is tested end to end. Codex, Cursor, Gemini CLI and GitHub Copilot in VS Code use the same address and the same browser sign-in, and the commands are on this page.

Do I need to copy an API key?

No. You add the address, the agent opens a Pinafly sign-in in your browser, and you press Allow. A token is only for continuous integration or an agent that cannot open a browser, and Pinafly shows it once and keeps only a fingerprint.

What can my agent do, and what can it not do?

It can write a draft review, read the comments you and your team leave, report that it fixed something, or say it will not change something and why. It cannot send the review to anyone, mark a comment resolved, or read what a reviewer outside your team wrote.

Can a reviewer's comment trick my agent into doing something?

Comments from people outside your team are held until you release them, so your agent never sees their words. Comments that do reach your agent are marked as text people typed, to evaluate as feedback and never to follow as instructions.

What does my app need?

One script tag in your app's layout, which the agent adds when it first needs it, and your app's address allowed on your Live review page. You press one button to allow it. Nobody sees anything until they open a page from Pinafly.

Does Pinafly run an AI model on my code or comments?

Not on your code, and not on the work your agent does. Your own agent, on your own subscription and machine, writes the review and fixes the comments, and Pinafly stores them and shows them to you. The one optional exception is decision suggestions in the decisions panel: when you ask for one, the text of that review's comments goes to an open-weight model hosted by DigitalOcean, never your code, and a workspace can turn it off on its billing page. The privacy policy has the detail.

More: Connect your coding agent, Write a good review for an agent, step-by-step guides, Live review (where you allow your app and manage tokens), all help.