MCP server

82 tools. Your permissions. No chatbot.

Solar exposes its whole surface over the Model Context Protocol. Your agent creates issues, moves epics, plans sprints, writes the knowledge base, drives a browser and opens pull requests — the same operations you perform in the UI, through the same permission checks, landing in the same activity log.

tools

endpoint

100/min

rate limit

JSON-RPC 2.0

protocol

If you skipped the spec

MCP is a plug for tools.

The Model Context Protocol is a small JSON-RPC contract between an agent and a system it needs to touch. The server advertises a list of tools — each one a name, a description, and a JSON schema for its arguments. The agent picks one and calls it. That is the entire idea.

It matters because you write the integration once. The same Solar server works in Claude Code, Claude Desktop, Cursor, Windsurf, or the agent you wrote yourself last Tuesday. No SDK per client, no glue per model.

Most products bolt a chat box onto the sidebar and call it AI. That gives the model your text. MCP gives it your buttons.

the whole handshake

01
initialize
Client says hello. Server answers with protocol version 2024-11-05 and its capabilities.
02
tools/list
Server returns the tools this token is allowed to see — up to all 82, with schemas.
03
tools/call
Agent invokes one by name with arguments. Server runs it as you and returns the result.

Solar answers POST with a JSON body. There is no server-initiated stream — a GET to the endpoint returns 405, and nothing in the tool surface needs one.

Connect

Two minutes, one URL.

The token is the endpoint. Solar puts it in the path rather than a header, so any client that can hit a URL can talk to Solar — no custom auth block, no OAuth dance.

01
Generate a token
Settings → MCP Tokens → Create Token. Pick the projects it can reach and whether each is read or full.
02
Copy it once
Solar stores a bcrypt hash, not the token. It is shown exactly once, at creation. Lose it and you make a new one — which is the correct behaviour and still annoying.
03
Paste the URL into your client
Append the token to https://app.projectsolar.space/api/mcp/ and hand that to your MCP config.
04
Ask it to list your issues
If list_projects comes back with your projects, you are connected. If it returns 401, the token is wrong or revoked.

.mcp.json · .cursor/mcp.json · any HTTP-capable client

{
  "mcpServers": {
    "solar": {
      "type": "http",
      "url": "https://app.projectsolar.space/api/mcp/a4f21c9b7e0d3856fa1b62c4d9e07f35b8c21a6d4e93f057c1b8a2e64d7f039c"
    }
  }
}

Same block works for Claude Code, Cursor and Windsurf. Swap the hex for your own token.

or, from the Claude Code CLI

claude mcp add --transport http solar \
  https://app.projectsolar.space/api/mcp/a4f21c9b7e0d3856fa1b62c4d9e07f35b8c21a6d4e93f057c1b8a2e64d7f039c

Writes the same entry for you. Use --scope project to commit it to the repo — and then remember that you have just put a live credential in git. Prefer --scope user.

claude_desktop_config.json · stdio-only clients

{
  "mcpServers": {
    "solar": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://app.projectsolar.space/api/mcp/a4f21c9b7e0d3856fa1b62c4d9e07f35b8c21a6d4e93f057c1b8a2e64d7f039c"
      ]
    }
  }
}

Some clients still launch MCP servers as local processes rather than calling a URL. mcp-remote is the usual bridge: it speaks stdio to the client and HTTP to Solar.

The whole surface

All 82. Not a highlight reel.

13 of these come with any token. 69 need full access on the project. A project or token config can switch individual tools off; they still appear in tools/list, prefixed (DISABLED), so the agent knows the tool exists and that it may not use it.

82 tools across 12 groups

Projects

Where an agent starts. Everything else takes a projectId.

list_projectsread

Every project the token can reach.

list_orgsreadgod mode

Every organisation. God-mode tokens only.

Issues

The bulk of the traffic. Read, write, comment, or create thirty at once.

list_issuesread

Issues in a project, with filters.

get_issueread

Full issue: comments, labels, custom fields, attachments. Images come back as MCP image blocks.

resolve_issue_keyread

Turn SOL-1 into a UUID.

create_issuefull

New issue. Type, priority, points, epic, queue, sprint, assignee.

update_issuefull

Change any of the above, including status.

batch_create_issuesfull

Many issues, one transaction.

add_commentfull

Comment on an issue.

Epics

Grouping above the issue. Deleting one unlinks its issues, it doesn't delete them.

list_epicsread

Epics in a project, filterable by status.

get_epicread

One epic and all its issues.

create_epicfull

New epic.

update_epicfull

Edit an epic.

delete_epicfull

Delete an epic. Its issues survive, unlinked.

batch_create_epicsfull

Many epics, one transaction.

Queues & sprints

Queues cut work by team. Sprints cut it by time. Agents read both, write queues.

list_queuesread

Queues in a project, with issue counts.

list_sprintsread

Sprints in a project.

create_queuefull

New queue.

update_queuefull

Edit a queue.

delete_queuefull

Delete a queue. Its issues survive, unlinked.

Knowledge base

Agents read the KB for context and write it back. Edits create a revision.

search_kbread

Ranked full-text search across every article.

list_kb_sectionsread

Section tree.

list_kb_articlesread

Articles by section, tag, or query.

get_kb_articleread

Article body, metadata, tags, links.

create_kb_articlefull

New article with title, content, section, tags.

update_kb_articlefull

Edit an article. Auto-creates a revision.

delete_kb_articlefull

Delete an article.

create_kb_sectionfull

New section.

link_kb_articlefull

Link an article to an issue, epic, or another article.

batch_create_kb_articlesfull

Many articles at once.

Agent resources & skills

Agents are first-class workers in Solar — they get a record, and skills attached to it. Yes, an agent can register another agent.

list_agent_resourcesfull

Non-human workers in an org.

create_agent_resourcefull

update_agent_resourcefull

Edit one.

delete_agent_resourcefull

Remove one.

set_agent_skillsfull

Replace the skill links on an agent with a list of skill IDs.

list_solar_skillsfull

Skills, optionally by category. Where you get the IDs.

create_solar_skillfull

Define a new skill.

update_solar_skillfull

Edit a skill's name, category, content, or active flag.

Browser automation

A real browser session, driven step by step. Open one, get a sessionId, then act against it.

browser_openfull

Start a session. Returns a sessionId.

browser_closefull

End the session, free the resources.

browser_navigatefull

Go to a URL.

browser_clickfull

Click by CSS selector or text.

browser_fillfull

Type into an input.

browser_selectfull

Pick a dropdown option.

browser_press_keyfull

Enter, Tab, Escape, whatever.

browser_snapshotfull

Accessibility tree of the current page.

browser_screenshotfull

Screenshot, base64.

browser_assert_textfull

Assert text is on the page.

browser_assert_elementfull

Assert a selector matches.

browser_waitfull

Wait for a selector, or a timeout.

browser_evaluatefull

Run JS in page context, get the result back.

browser_new_tabfull

New tab in an existing session.

browser_switch_tabfull

Switch by tab ID.

browser_close_tabfull

Close by tab ID.

browser_list_tabsfull

List the tabs.

Test scripts & runs

Saved browser scripts, plus a natural-language directive that compiles to one. Runs are async — you poll.

run_directivefull

Run a plain-English browser directive. Async, returns a runId.

run_test_scriptfull

Run a saved script by ID.

get_run_statusfull

Status, summary, and every step of a run.

create_test_scriptfull

New reusable script: steps, variables, tags.

get_test_scriptfull

One script, in full.

list_test_scriptsfull

Scripts for an org, filterable by project or tag.

update_test_scriptfull

Edit a script.

delete_test_scriptfull

Delete a script.

GitHub

Enough to take a ticket to an open PR without leaving the conversation.

github_list_reposfull

Repos for an org.

github_get_repofull

One repo's details.

github_create_repofull

New repository.

github_create_branchfull

New branch.

github_push_filesfull

Push one or more files to a branch.

github_create_prfull

Open a pull request.

Vercel

Ship it and then read the build logs when it goes red.

vercel_list_projectsfull

Projects on the connected account.

vercel_create_projectfull

New project, optionally linked to a repo.

vercel_set_env_varsfull

Set environment variables.

vercel_get_deploymentfull

Recent deployments for a project.

vercel_get_build_logsfull

Build logs for one deployment.

vercel_add_domainfull

Attach a custom domain.

Cloudflare

Pages, Workers, and the DNS records nobody wants to click through the dashboard for.

cloudflare_create_pages_projectfull

New Pages project, optionally linked to a repo.

cloudflare_get_deploymentsfull

Recent Pages deployments.

cloudflare_set_env_varsfull

Set environment variables on a Pages project.

cloudflare_create_workerfull

Create or update a Worker script.

cloudflare_manage_dnsfull

Create, list, or delete DNS records in a zone.

Scaffolding

Zero to a repo with starter files in two calls.

list_project_templatesfull

Available templates, filterable by framework.

scaffold_projectfull

Push a template's starter files into a GitHub repo.

Security model

An agent can do what you can do.

That is the deal. It is what makes the server useful and it is the thing to think about before you hand a token to something that writes its own plans.

The token is you

A token acts as the user who created it. Nothing more, nothing less. An agent holding a full-access token can create, edit and delete exactly what that person can — including deleting epics and queues. Scope tokens to the projects the agent actually needs.

Two access levels, per project

Every project on a token is marked read or full. Read tokens see 13 tools and cannot mutate anything. Full unlocks the other 69. Where a token spans several projects, Solar merges their configs to the most restrictive.

The URL is a secret

The token sits in the path, which makes setup trivial and makes the whole URL a credential. It will end up in your MCP config file and possibly in proxy logs. Do not paste it into a ticket, a screenshot, or a repo. Solar keeps only a bcrypt hash, and you can revoke a token at any time.

Nothing is invisible

Every agent action lands in the same activity feed as human work, tagged mcp and labelled with the token's name. Every tool call is logged with the tool name and whether it succeeded. If an agent made a mess on Tuesday, you can see it.

Client-safety rules still apply

Projects can force agent-created issues to internal and agent comments to private, and can disable named tools outright. The agent's copy of the tool list reflects those rules — it is told a tool is disabled rather than discovering it via an error.

God mode is deliberate

A token scoped to project * with full access reaches every project in every org, and gains list_orgs. It is admin-only and it is exactly as dangerous as it sounds. Most agents do not need it.

Limits100 requests per minute per token. Over that, the server returns JSON-RPC error −32000 with a Retry-After header. Agents in a tight loop will hit this; well-written ones back off.

Your agent is already open.

Give it a token and a project. It can do the rest of this page itself.

Start Free Read the docs

14-day trial · no credit card · unlimited MCP tokens