Hosted MCP

Instead of running shebang-mcp as a local stdio process, point an MCP-over-HTTP-capable harness straight at:

https://api.shebang.pro/mcp

It's the same tools, same schemas, same behavior as the stdio server — with one difference: no local filesystem. store_upload_file (which reads a path off disk) isn't registered on the hosted server; use store_upload_content instead, supplying bytes directly (contentBase64 or text) rather than a path.

The hosted server exposes 39 tools: 38 that are always on, plus store_upload_content. store_upload_file is local-only — it never appears on the hosted server, since there's no filesystem to read from.

Authentication

The hosted endpoint accepts either credential:

• An shb_… key, same as everywhere else: Authorization: Bearer shb_....
• A sherlock OAuth access token, obtained via the authorization-code flow (PKCE) against auth.shebang.pro — the same kind of token your own app would use to call a database's Data API as a signed-in user.

A request with neither gets 401 with a WWW-Authenticate: Bearer challenge naming https://api.shebang.pro/.well-known/oauth-protected-resource (RFC 9728), so a compliant OAuth client can discover the authorization server without any manual configuration.

Set up a harness

For the exact steps to register a harness as an OAuth client and complete the browser consent step, see MCP: hosted MCP — this page is just the landing pointer to that full walkthrough.

Next

Head back to concepts for the vocabulary — projects, keys, public ids, access modes — the rest of these docs assume.