Connect an AI app
Claude, ChatGPT, Cursor and other AI apps can deploy and manage your apps for you. Each connection acts as you, in one workspace.
Apps that ask for a server address
ChatGPT, claude.ai and other apps that take an address need no key.
- In the app, add a connector with this address. It is also on the Workspace page, under AI apps (MCP).
https://www.1clickops.com/api/mcp
- Sign in to 1ClickOps when it asks.
- Pick the workspace, and what it can do: Everything your role in that workspace allows, or Only look.
- Press Approve. Approve only an app you just started connecting from.
Apps that take a key
For Claude Code, OpenAI Codex, Gemini CLI, Cursor, VS Code, Windsurf, Claude Desktop and any other app that can send a key. Only a workspace owner or admin can make a key.
- Under AI apps (MCP), give it a name, choose Everything you can do or Only look, and when it Expires. Press Connect an app.
- Copy the key. It is shown once, and never again.
- Under Set it up in, pick your app and follow what it shows.
What it can do
It can do no more than your role allows. Your role is checked again on every action: remove someone and their connections stop.
It can look at your servers, apps, logs and backups. With full access it can also deploy, restart, stop and roll back apps, change settings, databases, domains and alerts, and install server updates. Each connection makes at most 30 changes an hour.
It deploys private repositories too, like the Repositories page. Your server makes a read-only key; its private half never leaves your server. With your GitHub sign-in it is added to the repository for you; otherwise you get the steps to add it yourself, read-only.
What it never does
- Show secret values. It can set one, but never read one back.
- Manage API keys, billing or members.
- Add SSH keys to a server for signing in.
Before anything risky
Most actions that delete, replace or could lock you out need the exact name of the app, server or account. The AI app is told to ask, never to guess.
Some, such as stopping an app or running a command in it, need no name, so read what the app plans before you agree. A change to how a server is signed in to undoes itself after 5 minutes unless it is kept. See How 1ClickOps protects your server.
How long it lasts
- Until you press Disconnect. It stops straight away, in every app and on every computer.
- A key also stops on its end date, if you chose one.
- Removing it from an app only removes it from that computer. It keeps working.
Every action is recorded
Each action is recorded: who, through which connection, what and how it ended. The values sent, such as a password, are not kept.