MCP Authentication

The InitRepo MCP server uses API key authentication. Your agent presents an API key with each request; the server verifies the key, identifies the associated account, and authorizes read-only access to that account's projects. Keys are created on a paid plan but, once issued, keep working with the documents you generated even if your subscription later ends.

Getting your API key

API keys are generated from your InitRepo account page. Each key can read the projects on your account. You can create multiple keys — one per agent or environment — and revoke individual keys without affecting others.

To generate a key: go to Account, find the API Keys section, and click "Create key." Give the key a descriptive name (e.g., "Claude Code — local dev" or "Cursor — project X") so you can identify which agent is using which key in your audit logs.

Configuring your agent

Once you have an API key, add it to your agent's MCP server configuration. The InitRepo MCP server endpoint and your API key are the two values required. The key is passed as a header on each MCP request; the server validates it before returning any resources.

For Claude Code, the configuration goes in your project's .claude/settings.json under mcpServers:

{
  "mcpServers": {
    "initrepo": {
      "command": "npx",
      "args": ["initrepo-mcp"],
      "env": {
        "INITREPO_API_KEY": "your-api-key-here",
        "INITREPO_PROJECT_ID": "your-project-id"
      }
    }
  }
}

The project ID is shown on your project's page in the InitRepo dashboard.

Key scopes and permissions

All keys grant access to the full MCP tool surface: reading documents and the context index, calling list_steps, search_spec, and get_step_context, and writing build-progress state via mark_step_complete. There is no separate read-only scope — the write surface is limited to progress tracking and does not touch your generated documents.

Keys are scoped to your account: an agent can access any project on that account but cannot reach other users' projects. You can create multiple keys and revoke individual ones without affecting others.

Security considerations

Treat API keys as secrets. Do not commit them to version control; use environment variables or a secrets manager. In .claude/settings.json, reference the key from an environment variable rather than pasting it directly. Rotate keys periodically, and immediately revoke any key you suspect has been exposed.

Your account page shows each key with the date it was created and when it was last used, so you can spot and revoke a key an agent is no longer using.