Hosted MCP

Instead of running shebang-mcp as a local stdio process, point any MCP-over-HTTP-capable harness straight at:

https://api.shebang.pro/mcp

It's the same tools, the same schemas, the same behavior as the stdio server (see tools reference) — with one difference: no local filesystem. store_upload_file reads a path off whatever disk the MCP server process can see; over stdio that's your own machine, but the hosted server runs inside shebang's own infrastructure, so a path there would name a file on shebang's side, not yours. The hosted endpoint omits store_upload_file entirely and registers store_upload_content in its place — upload by supplying the bytes directly (contentBase64 or text) instead of a path. Every other tool is identical between the two servers.

Authentication

The hosted endpoint accepts either credential, on the same header:

• An shb_… key, same as everywhere else — Authorization: Bearer shb_....
• A sherlock OAuth access token, obtained via the authorization-code flow (PKCE) against auth.shebang.pro — the same kind of token your own app would use to call a database's Data API as a signed-in user.

Both are checked by the same code path, so a tool call never knows or cares which kind of credential it received; a token's home project (if its OAuth client has one) scopes it exactly like an app key bound to that project.

A request with neither credential gets 401 with a WWW-Authenticate: Bearer header naming https://api.shebang.pro/.well-known/oauth-protected-resource — RFC 9728 protected-resource metadata — so a compliant OAuth client can discover the authorization server with no manual configuration at all.

Set up a harness

Claude Code discovers and registers itself with no key ever leaving your machine:

claude mcp add --transport http shebang https://api.shebang.pro/mcp

On first use, Claude Code calls /mcp, gets the 401 above, fetches the protected-resource document, follows authorization_servers to sherlock's own discovery document, finds its dynamic client registration endpoint, registers itself as a public OAuth client (PKCE, S256 only), and opens your browser to sherlock's consent screen. Approve there and every following call carries the issued access token automatically — nothing to copy, paste, or store yourself.

Any other HTTP-capable MCP harness that also does this discovery dance needs no more than the URL above. One that doesn't (or that you'd rather point at a plain key) can skip OAuth entirely and use a generic config with an shb_… key instead:

{
  "mcpServers": {
    "shebang": {
      "url": "https://api.shebang.pro/mcp",
      "headers": {
        "Authorization": "Bearer shb_..."
      }
    }
  }
}

Mint that key the same way as for the local server — see your first key — or register an OAuth client by hand with the oauth_create_client tool (or dynamic registration directly against sherlock) if your harness supports OAuth but not zero-configuration discovery.

Next

Hosted MCP (getting started) — the shorter landing version of this page. API reference — the 401/403 shapes, the api.shebang.pro rewrite, and the protected-resource document's exact response body.