The integration MCP server

Connect your AI coding agent to Hotline and it can perform the whole integration itself: read these docs, fetch exact embed code, diagnose origins, provision new ones, run a live end-to-end test against your instance, and report recent feedback. One token is the entire configuration.

• Connect
• Two scopes
• Install commands per agent
• The tools
• Token security
• Languages

Connect

In the dashboard, open your project → AI integration (MCP) → Generate token. The connection string is:

https://api.hotline.red/mcp/<token>

That URL is a standard MCP Streamable HTTP endpoint. There is nothing else to configure — no headers, no environment variables, no OAuth. The token is shown exactly once.

Two scopes

Hotline's hierarchy is organization → project → feedback item, and a token is issued at one of the first two levels:

	Project token	Organization token
Issued from	the project's AI integration (MCP) section	the organization editor (platform admin)
Reaches	one project	every project in the organization
project argument	not needed — ignored	required when the org has more than one project

Everything below works with either. An organization token adds list_projects, and its project-specific tools take a project argument (a project name or its public key). When the organization has exactly one project, the argument may be omitted; when it is genuinely ambiguous, the error lists the choices.

An organization token is still one tenant: naming a project from another organization is refused, in exactly the same words as naming one that does not exist.

Install commands per agent

The dashboard renders these with your real token filled in; with <connection> standing for the string above:

Agent	How
Claude Code	claude mcp add --transport http hotline "<connection>"
Cursor	.cursor/mcp.json: {"mcpServers":{"hotline":{"url":"<connection>"}}}
VS Code	code --add-mcp '{"name":"hotline","type":"http","url":"<connection>"}'
Gemini CLI	gemini mcp add hotline "<connection>" -t http
Codex CLI	~/.codex/config.toml: [mcp_servers.hotline] / url = "<connection>"
Anything else	Streamable HTTP, {"url":"<connection>"} — no headers required

The tools

Tool	Arguments	What it does
about_integration	—	Start here. The scope of this token, and what it is wired to: organization, project name(s), status, capture level, features, allowed origins. If the name is not what you expect, the site is on the wrong key — the most common failure, and it looks like CORS.
list_projects	—	The projects this token spans, with public keys and status. Pass any of them as project below.
get_docs	topic	These docs, verbatim: integration, csp, i18n, mcp.
get_embed_code	variant, project?	Ready-to-paste code with your real key: script, loader (tag managers), one-tag, path-proxy (the only CORS-free option), csp.
diagnose_origin	origin, project?	The same verdict as GET /v1/diagnose: would this origin work, and if not, exactly why.
check_page	url, project?	Fetches your deployed page and inspects the embed: tag present? type="module"? whose key? Public hosts only; redirects are reported, never followed.
run_e2e_test	withScreenshot?, project?	Submits a real (marked) ticket through the production ingest path, uploads a test screenshot through the real ticket→blob flow, verifies every row, then deletes everything. Pass/fail per step. Run it before declaring an integration done.
list_recent_feedback	limit, project?	The latest tickets. An organization token with no project reports across every project in the organization — id, status, page, title, whether a screenshot attached.
add_allowed_origin	origin, project?	Adds one origin to the allowlist (canonicalized, live in ~30s). Additive only — removing origins stays in the dashboard.

Token security

The token rides in the URL — that is what makes it work in every agent, including those that cannot send custom headers. Treat the connection string like a password:

• It is stored only as a hash; the raw value exists once, in the create dialog.
• Revoke any token instantly in the dashboard; last used shows whether an agent is actually using it.
• It authorizes the tools above for its own scope — it is not the instance secret (sk_*) and cannot access the dashboard, another organization, or your account.
• Suspending an organization cuts off its tokens, including the per-project ones beneath it.
• Don't commit it. If it may have leaked, revoke it and mint another; agents reconnect with the new string in one command.

Languages

?lang= on the connection string (e.g. …/mcp/<token>?lang=fr) is reserved for localized tool output. It is accepted today and English is served regardless.