MCP Server

This guide explains how to connect the information publishing system's MCP Server to an AI agent that supports MCP.

Through MCP, an agent can query devices, programs, assets, groups, and deployment relationships within the API Key owner's permission scope. It can also use automation capabilities such as device binding, activation code lookup, issue diagnosis, and dynamic control. MCP never bypasses system permissions.

Start with Cloud HTTP MCP

The cloud MCP service is already running. Create an API Key and configure your agent; no additional service is required. After that, use in-app MCP, stdio MCP, or Docker only when your deployment needs them.

Quick Start: Cloud HTTP MCP

Prerequisites

A valid cloud management account.
A recent management app version with API Key management.
Claude Code, Codex, Cursor, or another agent that supports Streamable HTTP MCP.

Step 1: Create a dedicated MCP API Key

Sign in to the management app.
Open API Keys from the avatar menu or Account Settings.
Create a key with a description such as MCP or the agent name, and choose a suitable expiration time.
Save the complete key immediately. The complete value is shown only once and cannot be retrieved from the list later.

Create a separate key for each agent so that it can be disabled, deleted, and audited independently.

Step 2: Configure your agent

Claude Code

bash

export CX_MCP_API_KEY='<your-cloud-api-key>'
export CX_MCP_AUTHORIZATION="ApiKey $CX_MCP_API_KEY"

claude mcp add --transport http \
  cx-cloud http://127.0.0.1:9394/mcp \
  --header "Authorization: $CX_MCP_AUTHORIZATION" \
  --header "X-Mht-Source-Key: cloud"

Codex

Set an environment variable containing the complete authorization value before starting Codex:

bash

export CX_MCP_AUTHORIZATION='ApiKey <your-cloud-api-key>'

Edit ~/.codex/config.toml:

toml

[mcp_servers.cx_cloud]
url = "http://127.0.0.1:9394/mcp"
http_headers = { "X-Mht-Source-Key" = "cloud" }
env_http_headers = { "Authorization" = "CX_MCP_AUTHORIZATION" }

env_http_headers reads the header value from the environment, so the key does not need to be stored in config.toml. See the official OpenAI MCP documentation for this option.

Step 3: Verify

bash

# Claude Code
claude mcp list
claude mcp get cx-cloud

# Codex
codex mcp list
codex mcp get cx_cloud

After the server is connected and its tools are visible, try:

"List all my devices."
"Check the current program on this device."
"Which devices is this program deployed to?"

Sources and API Keys

MCP supports Cloud and LAN sources. The API Key must be created by an account in the corresponding source.

	Cloud	LAN
Use case	Online and remote management	Intranet or offline deployment
Primary API Key	Created by a cloud account	Created by the current LAN service account
Prerequisite	Cloud MCP is deployed	Enable the LAN service in the management app
Cloud-only tools such as activation codes	Available through the primary key	Optionally provide a Cloud API Key

Cloud HTTP headers

text

Authorization: ApiKey <cloud-key>
X-Mht-Source-Key: cloud

LAN HTTP headers

text

Authorization: ApiKey <lan-key>
X-Mht-Source-Key: lan
X-Mht-Lan-Host: http://127.0.0.1:9393

When a LAN source needs activation codes or other cloud-only tools, also provide:

text

X-Mht-Cloud-Authorization: ApiKey <cloud-key>

The two keys have different purposes: the LAN API Key accesses the current LAN service; the Cloud API Key only accesses cloud-specific capabilities. Regular LAN device and program queries do not need a Cloud API Key.

In-App HTTP MCP

Open the LAN Services page in the management or player app and enable MCP. The page displays an address similar to:

text

http://192.168.1.10:9394/mcp

Agents on the same network should use this address. Do not use 127.0.0.1 unless the agent and app run on the same device.

In-app MCP uses the same headers as the standalone HTTP service. Use a cloud API Key for Cloud source. For LAN source, use a LAN service API Key and configure the actual LAN host.

stdio MCP

cxmcp_stdio is started by the agent on demand and does not require a persistent HTTP MCP process. For regular use, pass raw key values through environment variables.

Cloud

bash

export CX_MCP_API_KEY='<cloud-key>'
/path/to/cxmcp_stdio --source cloud

You can select a custom environment variable name:

bash

export MY_CX_API_KEY='<cloud-key>'
/path/to/cxmcp_stdio \
  --source cloud \
  --api-key-env MY_CX_API_KEY

LAN

bash

export CX_MCP_API_KEY='<lan-key>'
export CX_MCP_CLOUD_API_KEY='<cloud-key>' # optional

/path/to/cxmcp_stdio \
  --source lan \
  --lan-host http://127.0.0.1:9393

The only supported credential options are:

--api-key and --api-key-env; the default environment variable is CX_MCP_API_KEY.
--cloud-api-key and --cloud-api-key-env; the default environment variable is CX_MCP_CLOUD_API_KEY.

Command-line key values are useful for temporary debugging. Prefer environment variables for persistent configurations so keys do not appear in command history.

Docker stdio MCP

The Docker image is still a stdio MCP server. Use docker run -i; no port mapping is needed.

Cloud

bash

docker run -i --rm \
  -e CX_MCP_API_KEY='<cloud-key>' \
  <cxmcp-stdio-image> \
  --source cloud

LAN

bash

docker run -i --rm \
  --add-host=host.docker.internal:host-gateway \
  -e CX_MCP_API_KEY='<lan-key>' \
  -e CX_MCP_CLOUD_API_KEY='<cloud-key>' \
  <cxmcp-stdio-image> \
  --source lan \
  --lan-host http://host.docker.internal:9393

On Docker Desktop, use host.docker.internal to reach a service on the host. On Linux, keep the --add-host option when that hostname is not provided automatically.

Complete Agent Configurations

Claude Code: HTTP LAN

bash

export CX_MCP_LAN_AUTHORIZATION='ApiKey <lan-key>'
export CX_MCP_CLOUD_AUTHORIZATION='ApiKey <cloud-key>' # optional

claude mcp add --transport http \
  cx-lan http://127.0.0.1:9394/mcp \
  --header "Authorization: $CX_MCP_LAN_AUTHORIZATION" \
  --header "X-Mht-Source-Key: lan" \
  --header "X-Mht-Lan-Host: http://127.0.0.1:9393" \
  --header "X-Mht-Cloud-Authorization: $CX_MCP_CLOUD_AUTHORIZATION"

Remove the final header when cloud-only tools are not needed.

Claude Code: stdio

bash

# Cloud
claude mcp add cx-cloud-stdio \
  -e CX_MCP_API_KEY='<cloud-key>' \
  -- /path/to/cxmcp_stdio --source cloud

# LAN
claude mcp add cx-lan-stdio \
  -e CX_MCP_API_KEY='<lan-key>' \
  -e CX_MCP_CLOUD_API_KEY='<cloud-key>' \
  -- /path/to/cxmcp_stdio \
    --source lan \
    --lan-host http://127.0.0.1:9393

Codex: HTTP LAN

bash

export CX_MCP_LAN_AUTHORIZATION='ApiKey <lan-key>'
export CX_MCP_CLOUD_AUTHORIZATION='ApiKey <cloud-key>' # optional

toml

[mcp_servers.cx_lan]
url = "http://127.0.0.1:9394/mcp"
http_headers = { "X-Mht-Source-Key" = "lan", "X-Mht-Lan-Host" = "http://127.0.0.1:9393" }
env_http_headers = { "Authorization" = "CX_MCP_LAN_AUTHORIZATION", "X-Mht-Cloud-Authorization" = "CX_MCP_CLOUD_AUTHORIZATION" }

Remove X-Mht-Cloud-Authorization from env_http_headers when cloud-only tools are not needed.

Codex: stdio

toml

[mcp_servers.cx_cloud_stdio]
command = "/path/to/cxmcp_stdio"
args = ["--source", "cloud"]
env = { "CX_MCP_API_KEY" = "<cloud-key>" }

[mcp_servers.cx_lan_stdio]
command = "/path/to/cxmcp_stdio"
args = ["--source", "lan", "--lan-host", "http://127.0.0.1:9393"]
env = { "CX_MCP_API_KEY" = "<lan-key>", "CX_MCP_CLOUD_API_KEY" = "<cloud-key>" }

Cursor: HTTP Cloud

Configure ~/.cursor/mcp.json:

json

{
  "mcpServers": {
    "cx-cloud": {
      "url": "http://127.0.0.1:9394/mcp",
      "headers": {
        "Authorization": "ApiKey <cloud-key>",
        "X-Mht-Source-Key": "cloud"
      }
    }
  }
}

If the agent supports reading headers from environment variables, prefer that feature so the key does not enter the configuration file.

Frequently Asked Questions

Connection or tool call failures

Check the following:

The API Key is still enabled.
The API Key has not expired or been deleted.
The HTTP header uses the exact ApiKey <key> format.
The Cloud or LAN key matches the current source.
The key owner has permission for the requested operation.
LAN has X-Mht-Source-Key: lan and the correct X-Mht-Lan-Host.
LAN cloud-only tools have an additional valid Cloud API Key.

An invalid API Key is not recovered automatically. Create or enable a usable key and update the agent configuration.

The tools list is empty

Verify the MCP URL and port.
Verify that the complete authorization header reaches the MCP client.
Reconnect the server in the agent, for example by running /mcp again in Claude Code.
Check the source and key owner's permissions.

HTTP MCP port is already in use

For a locally hosted service, choose another port:

bash

cxmcp_http --port=9395

Update the URL in the agent configuration as well. This does not apply to the hosted Cloud HTTP MCP service.

Using LAN and Cloud at the same time

Configure two servers, such as cx_cloud and cx_lan. They can point to the same MCP URL, but each requires the API Key and source header for its own source.

Security Notes

Create a dedicated API Key for MCP instead of sharing one with another integration.
Choose an expiration time that matches the intended use and rotate keys regularly.
The complete key is shown only once; store it securely immediately after creation.
Prefer environment variables or private local configuration. Never commit a key to a repository.
Disable or delete a key immediately when it is no longer needed.
HTTP MCP binds to 127.0.0.1 by default. Listen on an external interface only with deliberate network access controls.

MCP Server ​

Quick Start: Cloud HTTP MCP ​

Prerequisites ​

Step 1: Create a dedicated MCP API Key ​

Step 2: Configure your agent ​

Claude Code ​

Codex ​

Step 3: Verify ​

Sources and API Keys ​

Cloud HTTP headers ​

LAN HTTP headers ​

In-App HTTP MCP ​

stdio MCP ​

Cloud ​

LAN ​

Docker stdio MCP ​

Cloud ​

LAN ​

Complete Agent Configurations ​

Claude Code: HTTP LAN ​

Claude Code: stdio ​

Codex: HTTP LAN ​

Codex: stdio ​

Cursor: HTTP Cloud ​

Frequently Asked Questions ​

Connection or tool call failures ​

The tools list is empty ​

HTTP MCP port is already in use ​

Using LAN and Cloud at the same time ​

Security Notes ​

MCP Server

Quick Start: Cloud HTTP MCP

Prerequisites

Step 1: Create a dedicated MCP API Key

Step 2: Configure your agent

Claude Code

Codex

Step 3: Verify

Sources and API Keys

Cloud HTTP headers

LAN HTTP headers

In-App HTTP MCP

stdio MCP

Cloud

LAN

Docker stdio MCP

Cloud

LAN

Complete Agent Configurations

Claude Code: HTTP LAN

Claude Code: stdio

Codex: HTTP LAN

Codex: stdio

Cursor: HTTP Cloud

Frequently Asked Questions

Connection or tool call failures

The tools list is empty

HTTP MCP port is already in use

Using LAN and Cloud at the same time

Security Notes