One endpoint · 61 tools · API keys only
Client setup
Add an MCP server to Claude Code, Cursor or Copilot
This page sets up one particular MCP server, datapipelines.co's, the one that puts your
SQL databases behind role-checked, audited, read-only-by-default credentials. It is not a general directory of
MCP servers. If you came looking for how the mcp add mechanics work, they are the same either
way, and the four steps below are the whole job.
Step 1
Have a server to point at
Self-hosted, so the first step is yours. The quickstart brings up the app, Postgres, Redis and a seeded demo with real NYC taxi data in one command:
./app.sh --start --demo nyc,trade,lakeFor your own databases, register a datasource per engine. Postgres, SQL Server, SQLite, DuckDB, H2 and dp-lake ship in the published image; you supply the MySQL and Oracle drivers, because of their licenses. Engine-by-engine details.
Step 2
Create your MCP key on the Keys page
Sign in, open the Keys page, and choose New API key: pick the kind
mcp and the role the agent should carry. The dialog offers exactly the roles whose permissions
are a subset of yours. Create shows the full key once, and the server keeps only a hash
afterwards, so copy it straight into the client config in step 3. Rotation later is the same page: revoke
the key, create another.
The key holds the role you gave it, as an identity of its own. What the agent may do, by the role the key carries:
| The key's role | The agent may… |
|---|---|
| Author | create and update pipelines and templates, run them, probe SQL, preview rows and publish endpoints |
| Promoter | read released-and-newer pipelines and templates, and datasource schemas. That is the promotion reviewer's reach, nothing executable |
| Workspace admin | everything an author's key reaches, plus administering the workspace itself. No key is ever a super admin, so instance administration stays out of reach |
Administration of the instance stays with signed-in people; no key can hold it. The key's role is fixed at creation: your later role changes do not flow into it.
Rotating means revoking the key on the Keys page and creating another under a fresh name; revocation takes effect within about a minute. There is no shared password to rotate.
Step 3
Paste one config block
Every client needs the same two facts: the endpoint POST {host}/mcp, over Streamable HTTP, and
an API key in DP-API-Key, or in Authorization: Bearer dpk_… for clients that can
only set the standard header. Both route through the identical validation path. Browser session cookies are
rejected on /mcp, deliberately.
The Claude Code MCP server config
claude mcp add --transport http datapipelines https://your-host/mcp \
--header "DP-API-Key: dpk_<id>.<secret>"The Cursor MCP server config: ~/.cursor/mcp.json
{
"mcpServers": {
"datapipelines": {
"url": "https://your-host/mcp",
"headers": { "DP-API-Key": "dpk_<id>.<secret>" }
}
}
}The GitHub Copilot MCP server config: .vscode/mcp.json
{
"servers": {
"datapipelines": {
"type": "http",
"url": "https://your-host/mcp",
"headers": { "DP-API-Key": "dpk_<id>.<secret>" }
}
}
}Claude Desktop and other JSON-configured clients
{
"mcpServers": {
"datapipelines": {
"url": "https://your-host/mcp",
"headers": { "Authorization": "Bearer dpk_<id>.<secret>" }
}
}
}The URL and the header are ours, and specified above. The file names and the JSON shape around them belong to each client and change when its vendor changes them. Check the client's own documentation if a block here is refused, and tell us so we can fix the page.
Step 4
Check that the tools came back
Ask the agent to list its tools. A working connection reports 61 from this
server, starting with pipelines_list and datasources_list. Nothing else needs
configuring: capabilities come from the standard initialize handshake.
If it does not connect
401 auth.api_key.missing: the header did not arrive. Check the header name, and that the client sends headers at all on HTTP transports.401 auth.api_key.invalidorauth.api_key.expired: wrong, revoked or expired.401 auth.principal_deactivated: the key's identity or its MCP-key creator is deactivated. Ask an administrator to reactivate the account.auth.role_required, as the tool's result: the key is real and the role it carries does not reach what the agent tried. The key acts at its own role: to widen its reach, create another key with a wider role, which the dialog offers only when your own role reaches that far.- Silent rejection of a browser session: expected.
/mcptakes API keys only; a cookie will never work there.
Asked before
Client setup, in questions
Which MCP client should I use?
Any client that speaks MCP over Streamable HTTP: Claude Code, Cursor, GitHub Copilot and JSON-configured clients like Claude Desktop all take the same two facts: the POST /mcp endpoint and an API key header. The transport and authentication are docs/mcp-server.md §3.2.
What role does the agent's key carry?
The one you chose at creation: the Keys page dialog offers exactly the roles whose permissions are a subset of yours, and viewer is never one of them. An author-role key browses, runs and drafts, a promoter-role key reads released content, and a workspace-admin-role key also administers the workspace. The rule is docs/auth.md §7.5.
Which database drivers ship in the image?
Postgres, SQL Server, SQLite, DuckDB, H2 and dp-lake are bundled; the MySQL and Oracle drivers are user-supplied for license reasons, and registering a datasource whose driver is absent fails at save time. The driver matrix is docs/deployment.md §3.5.
The tools did not come back: what now?
Read the refusal: auth.api_key.missing means the header did not arrive; invalid or expired means wrong, revoked or expired; auth.principal_deactivated means the key's identity or MCP-key creator is deactivated; auth.role_required means the key's own role does not reach that tool. A silently ignored browser session is expected, because /mcp takes API keys only. The refusal codes are docs/pipeline-contract.md §13.7; the transport is docs/mcp-server.md §4.2.
Do the whole loop on the demo
The demo stack is one command, and every step on this page works against it: sign in, create the key on the Keys page, paste the config, list the tools, run a pipeline. Connecting to your own databases is the same ritual with real stakes.