answer.cloud MCP: Overview, Connection & Authentication

What the answer.cloud MCP server is, how to connect a coding agent, and how Bearer authentication, protocol negotiation, rate limits, and errors work.

Published July 20, 2026

The answer.cloud MCP server lets a coding agent (Claude Code, Codex, or any MCP client) create sites, deploy static artifacts, manage GitHub push-to-deploy, and author CMS content on answer.cloud — without leaving the terminal. This page covers what the server is, how to connect, and how authentication, protocol negotiation, rate limits, and errors work. The individual tools are documented in the companion pages for site & deploy tools, GitHub tools, and CMS tools.

What the MCP server is

answer.cloud exposes a single Model Context Protocol endpoint that speaks JSON-RPC 2.0 over Streamable HTTP. Every call is a self-contained HTTP POST — there is no SSE stream and no long-lived session to manage. You send one JSON-RPC request, you get one JSON-RPC response.

The server groups its tools into three families:

• Site & deploy tools — create sites and ship static artifacts through the deploy pipeline.
• GitHub tools — connect a GitHub App installation and wire up push-to-deploy.
• CMS tools — define collections and author, preview, publish, and archive entries.

Endpoint and transport

• URL: https://answer.cloud/mcp
• Transport: Streamable HTTP (JSON-RPC 2.0), Bearer authentication
• Methods: initialize, tools/list, and tools/call
• Batching: not supported — send one request per HTTP call, not a JSON array
• HTTP verb: POST only; a GET to the endpoint returns 405 Method Not Allowed

Authentication

Every request must carry a hosting API key as a Bearer token:

Authorization: Bearer aeo_host_YOUR_KEY

Hosting API keys start with the aeo_host_ prefix and are minted in the answer.cloud dashboard under Settings → API & MCP. A key is shown in full exactly once at creation time — copy it immediately; if you lose it, revoke it and issue a new one.

Keys are organization-scoped: one key can act on every site in the organization that owns it. The server resolves the organization directly from the token, so no organization parameter is ever required. Only a salted digest of the key is stored, never the key itself.

If a call returns Unauthorized: provide a valid hosting API key as a Bearer token., the key is missing, malformed, revoked, or belongs to a different environment than the endpoint you are calling.

Protocol version

Send the negotiated protocol version on every request:

MCP-Protocol-Version: 2025-11-25

The server currently accepts 2025-11-25 (current), 2025-06-18, and 2025-03-26. An unrecognized version is rejected before the call runs.

Rate limits and quotas

• Request rate: 60 requests per minute per key. Exceeding it returns a rate_limited error.
• Daily deploys: deploy-consuming tools draw from a daily quota — 30/day on free plans, 200/day on paid. Each deploy response reports deploys_remaining_today. A deploy that fails before it starts processing refunds the quota.

Because polling get_deploy counts against the request rate, poll on the cadence the response suggests (retry_after_seconds) rather than in a tight loop.

How results and errors are shaped

A successful tools/call returns the tool's data as JSON in both content[0].text (a pretty-printed string) and structuredContent (the same object, parsed). Prefer structuredContent.

Tool-level failures come back as a result with isError: true and a body of { "error": "<code>", "message": "<human-readable next step>" }. The error code is stable and machine-readable; the message tells you what to do next. Common codes include:

• card_required — the organization has no card on file; finish signup before creating sites or deploying.
• not_found / invalid_site — the site slug does not exist in this organization.
• too_large — the uploaded artifact exceeds the plan's size ceiling.
• rate_limited — you hit the per-minute request limit or the daily deploy quota.
• not_live / cms_no_live_deploy — the operation needs a site that has already deployed at least once.

Malformed JSON-RPC (bad method, unknown tool, batch array) returns a standard JSON-RPC error object instead, with codes such as -32600 and -32602.

Minimal request example

curl -sS -X POST https://answer.cloud/mcp \
  -H "Authorization: Bearer aeo_host_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -H "MCP-Protocol-Version: 2025-11-25" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": { "name": "list_sites", "arguments": {} }
  }'

Connecting from a coding agent

Most users never call the endpoint by hand — they register it once with their agent.

Claude Code:

claude mcp add --transport http answercloud https://answer.cloud/mcp \
  --header "Authorization: Bearer aeo_host_YOUR_KEY"

Codex — add to ~/.codex/config.toml:

[mcp_servers.answercloud]
url = "https://answer.cloud/mcp"
bearer_token_env_var = "AEOPRESS_API_KEY"

Then export the key so the session picks it up:

export AEOPRESS_API_KEY=aeo_host_YOUR_KEY

Frequently asked questions

Do I need to pass my organization ID?

No. The key encodes which organization it belongs to, and the server derives the organization from the token. You only ever pass a site_slug to target a specific site.

Why did my key work against one URL but not another?

Keys are tied to the environment that issued them. A key created in production only authenticates against the production endpoint; a local or staging key will not.

How do I recover from card_required?

Add a card on file in the dashboard and finish signup. Site creation and deploys are gated on a valid payment method even on free usage tiers.