---
title: MCP clients
description: Set up the Dekka MCP server in Claude Code, Claude Desktop, Cursor, VS Code, Codex, Windsurf and other MCP clients.
section: Agents
order: 2
updated: 2026-11-04
---

Every client needs the same two things, which are the server address `https://mcp.dekka.cloud/mcp` and an `Authorization` header carrying a Dekka API key. The **Agents** tab in your organisation's settings creates a key and shows each of these snippets with it filled in. The examples here read the key from `DEKKA_API_KEY` so it stays out of files you might commit.

## Claude Code

Add the server from a terminal. Use `--scope user` to make it available in every project, or leave it out to add it to the current one only.

```bash
claude mcp add --transport http dekka https://mcp.dekka.cloud/mcp \
  --header "Authorization: Bearer $DEKKA_API_KEY"
```

Run `/mcp` inside Claude Code to see the server's status and its tools.

## Claude Desktop

Claude Desktop starts local servers from its config file, so it reaches a remote server through `mcp-remote`, which needs Node.js. Open **Settings → Developer → Edit Config** and add the server to `claude_desktop_config.json`, then restart Claude Desktop.

```json title="claude_desktop_config.json"
{
  "mcpServers": {
    "dekka": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://mcp.dekka.cloud/mcp", "--header", "Authorization:${DEKKA_AUTH}"],
      "env": { "DEKKA_AUTH": "Bearer dk_your_key" }
    }
  }
}
```

The header is written without a space after the colon and filled from `env`, which avoids a quoting problem with arguments on Windows.

## Cursor

Add the server to `~/.cursor/mcp.json` for every project, or to `.cursor/mcp.json` in one repository.

```json title="~/.cursor/mcp.json"
{
  "mcpServers": {
    "dekka": {
      "url": "https://mcp.dekka.cloud/mcp",
      "headers": { "Authorization": "Bearer ${env:DEKKA_API_KEY}" }
    }
  }
}
```

## VS Code

Add the server to `.vscode/mcp.json`. VS Code asks for the key the first time the server starts and keeps it in its secret storage, so the file is safe to commit.

```json title=".vscode/mcp.json"
{
  "inputs": [{ "type": "promptString", "id": "dekka-key", "description": "Dekka API key", "password": true }],
  "servers": {
    "dekka": {
      "type": "http",
      "url": "https://mcp.dekka.cloud/mcp",
      "headers": { "Authorization": "Bearer ${input:dekka-key}" }
    }
  }
}
```

The tools appear in Copilot Chat's agent mode.

## Codex

Add the server to `~/.codex/config.toml` and export the key in your shell. Codex sends it as a bearer token.

```toml title="~/.codex/config.toml"
[mcp_servers.dekka]
url = "https://mcp.dekka.cloud/mcp"
bearer_token_env_var = "DEKKA_API_KEY"
```

## Windsurf

Add the server to `~/.codeium/windsurf/mcp_config.json`.

```json title="mcp_config.json"
{
  "mcpServers": {
    "dekka": {
      "serverUrl": "https://mcp.dekka.cloud/mcp",
      "headers": { "Authorization": "Bearer ${env:DEKKA_API_KEY}" }
    }
  }
}
```

## Other clients

Any client that supports remote servers over Streamable HTTP and lets you set a header will work. Where a client only starts local servers, run it through `mcp-remote` as in the Claude Desktop example.

To see the tools and try them by hand, use the MCP Inspector.

```bash
npx @modelcontextprotocol/inspector
```

Choose **Streamable HTTP**, enter the server address, and add the `Authorization` header with your key.

## Read-only sessions

Add `?read_only=true` to the address to hide every tool that changes something, whatever the key allows. It's a quick way to let an agent investigate a problem without the chance of it fixing the wrong thing.

```text
https://mcp.dekka.cloud/mcp?read_only=true
```

## When it doesn't connect

A `401` means the key is missing, mistyped, revoked or expired, or it's an AI Gateway key, which reaches only the gateway. Create a new one in the **Agents** tab and check the header reads `Authorization: Bearer dk_...` with a single space after `Bearer`.

If the server connects but a tool you expected is missing, the key's scopes don't include it. A read key sees only the tools that look at things, a write key adds the ones that change things, and deleting needs full access. [MCP security](/docs/mcp-security) has the full list.