Xyvenra

Remote MCP server for Xyvenra. Create and manage Cloud, Data, Studio, and Mobile projects, deploy or export work, and work with environment variables and Data records. Sign in with OAuth 2.1.

View on xyvenra.com

Hosted MCP Server

npx add-mcp 'https://xyvenra.com/api/mcp'

Installs into Claude Code, Codex, Cursor and more

Documentation

MCP

The remote MCP server is POST https://xyvenra.com/api/mcp. Use OAuth 2.1 first. A platform API key is the fallback.

Connect

The official registry listing is io.github.LAHutchins91/xyvenra, version 0.1.1. It points at https://xyvenra.com/api/mcp and does not require an Authorization header. Icons are icon.svg and apple-icon.png. The website is https://xyvenra.com.

OAuth 2.1 uses protected-resource metadata, authorization-server metadata, dynamic client registration, PKCE S256, and scope xyvenra. Consent reuses GitHub or Google sign-in. An access token is bound to the same account as a platform key.

Protected resource: https://xyvenra.com/.well-known/oauth-protected-resource/api/mcp
Authorization server: https://xyvenra.com/.well-known/oauth-authorization-server
Authorize, token, register, and revoke: /oauth/authorize, /oauth/token, /oauth/register, /oauth/revoke

Fallback: a person signs in and creates a key at https://xyvenra.com/app/keys. The plaintext secret is shown once. Prefix xyv_plat_. Send it as Authorization: Bearer xyv_plat_.... Early access limit: 60 requests per minute. Agents cannot complete signup or key creation in a browser.

Directory discovery

initialize, ping, notifications/initialized, tools/list, prompts/list, and resources/list answer without a token. The tool list is public. Prompts and resources are empty. tools/call and every other method require OAuth or a platform API key. A missing or rejected token returns HTTP 401 with WWW-Authenticate pointing at the protected-resource metadata above. Those responses contain no account data.

Server card: https://xyvenra.com/.well-known/mcp/server-card.json. The same JSON is also at /api/mcp/.well-known/mcp/server-card.json. It lists the live tools and marks OAuth 2.0 or a bearer key as required for calls.

Tools

create_project — Cloud site (name and slug), Data project, Studio app, or Mobile Expo starter. product: code is an error and points at /app/code. Nothing is deployed or charged.
list_projects — owned Cloud, Data, Studio, or Mobile rows. Code returns the browser-workspace note.
project — get reads a Cloud page, Studio source, or Mobile draft. save replaces Studio source or a Mobile draft. A Mobile save requires expectedUpdatedAt from the last get or save. Saving does not publish a site or start an EAS build. Cloud HTML is published with deploy.
deploy — publish self-contained HTML, or a saved Studio page when projectId is passed instead of html. Public env vars for that site are written into the page. Private values are not.
export — Studio source ZIP, Mobile Expo ZIP, or Data JSON snapshot. The Mobile ZIP does not start an EAS build.
env_vars — list, set, update, or delete. exposure is secret by default or public. Only public values are copied into a Cloud page.
database — list_tables, create_table, delete_table, list_records (filter, search, order, limit, offset, or cursor over the latest 250 rows), list_changes, get_record, create_record (one data object or a records batch of 1 to 250), update_record (optional expectedUpdatedAt), and delete_record. Field changes stay in the Data app.
files — list, upload, download, or delete private Data files. Uploads are base64, at most 1 MB, within 100 files and 50 MB per account.
eas_dispatch — dispatch one workflow on the customer’s Expo project with the Expo token supplied for that call. The token is not stored. Xyvenra does not pay Expo.
guidance — ask once about a real next step. Decline turns a path off. continue creates only the step you name. It does not deploy or charge.
status — Code, Cloud, Data, Mobile, and Studio for this account.

Limits

Cloud publishes static HTML (180 KB) or a static-site ZIP through a Cloud deploy key. It is not a Node or Next.js host. There is no server runtime.
Env values are stored for the account. Secret is the default. A Cloud publish writes public values into the static page and leaves private values out.
Data is projects, typed tables, records, a record poll, and private files. It is not Supabase Auth, a public storage bucket, Realtime, or Edge Functions. Project API keys (xyv_data_) are created in the Data app.
Paid Cloud, Data, Mobile, and Studio plans are still coming soon. This server does not take payment.

Terms: https://xyvenra.com/terms. Privacy: https://xyvenra.com/privacy. REST examples stay on the API reference.