MCP Server

Quackback includes an MCP (Model Context Protocol) server, so AI agents and AI coding tools can search, triage and respond to feedback, work the support inbox and tickets, and manage help center content. This article covers turning it on, connecting a client, and authentication and scopes.

Note: On Quackback Cloud, the MCP server is included from the Pro plan.

What agents can do

• Search and filter feedback across boards, statuses and tags
• Triage posts: update status, assign owners and tag
• Review AI suggestions: accept, dismiss and restore merge suggestions
• Create, update and delete posts and changelog entries
• Comment, vote and react on feedback, including votes on behalf of customers
• Merge and unmerge duplicate posts
• Work the support inbox: list and read conversations, reply to customers, and open, snooze or close conversations (when the Support module is on)
• Work support tickets: list and read tickets, open new ones, reply, add internal notes, and link tickets to trackers
• Upload files to attach to replies and notes
• Read resources: boards, statuses, tags, roadmaps, team members and help center categories
• Manage the help center: create, update, publish and delete articles and categories (when the Help Center module is on)

See the MCP tool reference for every tool and its parameters.

Set up

1. Turn on the MCP server

Go to Admin > Settings > Developers, open the MCP tab, and turn on MCP server. The tab also shows your Endpoint and a setup guide with ready-made configs for common clients.

Your endpoint is your workspace's address followed by /api/mcp, for example https://feedback.example.com/api/mcp.

2. Choose how the client signs in

• OAuth: clients that support MCP OAuth (such as Claude Code and Cursor) can connect with just the URL and sign you in through the browser. New OAuth apps can register themselves while Dynamic client registration is on (in the same tab). Already-connected apps keep working when you turn it off.
• API key: create a key on the Keys tab of Admin > Settings > Developers. Give it a descriptive name (for example "Claude Code") and choose its access. The key starts with qb_ and is shown only once, so copy it immediately.

3. Connect your client

Replace feedback.example.com with your workspace's address.

Claude Code

Add to .mcp.json in your project root, with QUACKBACK_API_KEY set in your environment:

{
  "mcpServers": {
    "quackback": {
      "type": "http",
      "url": "https://feedback.example.com/api/mcp",
      "headers": {
        "Authorization": "Bearer ${QUACKBACK_API_KEY}"
      }
    }
  }
}

Or use the CLI:

claude mcp add --transport http quackback https://feedback.example.com/api/mcp \
  --header "Authorization: Bearer $QUACKBACK_API_KEY"

To use OAuth instead, leave out the headers block.

Cursor

Add to .cursor/mcp.json in your project root:

{
  "mcpServers": {
    "quackback": {
      "url": "https://feedback.example.com/api/mcp",
      "headers": {
        "Authorization": "Bearer ${env:QUACKBACK_API_KEY}"
      }
    }
  }
}

VS Code

Add to .vscode/mcp.json. VS Code asks for the key on first use and stores it securely. Note the top-level key is servers, not mcpServers.

{
  "inputs": [
    {
      "type": "promptString",
      "id": "quackback-api-key",
      "description": "Quackback API Key (qb_...)",
      "password": true
    }
  ],
  "servers": {
    "quackback": {
      "type": "http",
      "url": "https://feedback.example.com/api/mcp",
      "headers": {
        "Authorization": "Bearer ${input:quackback-api-key}"
      }
    }
  }
}

Windsurf

Add to ~/.codeium/windsurf/mcp_config.json. Windsurf uses serverUrl instead of url.

{
  "mcpServers": {
    "quackback": {
      "serverUrl": "https://feedback.example.com/api/mcp",
      "headers": {
        "Authorization": "Bearer ${env:QUACKBACK_API_KEY}"
      }
    }
  }
}

Claude Desktop

Claude Desktop needs the mcp-remote bridge (Node.js must be installed). Add to claude_desktop_config.json:

{
  "mcpServers": {
    "quackback": {
      "command": "npx",
      "args": [
        "mcp-remote@latest",
        "--http",
        "https://feedback.example.com/api/mcp",
        "--header",
        "Authorization: Bearer qb_YOUR_API_KEY"
      ]
    }
  }
}

Authentication and scopes

API keys (qb_ prefix) hold the access chosen when the key was created, limited by what the creator's role allows. Keys are created by teammates whose role can manage API keys (Owner and Admin by default). Older keys created before access levels existed keep full access.

OAuth connections start with the three read scopes. When a tool needs a write scope the client doesn't have yet, the server answers HTTP 403 insufficient_scope so the client can ask you to approve more.

When you create a key, the Access picker maps to these scopes: Feedback, Changelog, Help Center and Conversations, each with Read, Read and write, or Write.

Attribution

Every API key acts as its own identity. When an agent triages a post, the activity log shows which key did it, so use clear key names such as "GitHub Actions" or "Claude Code".

Related articles

• MCP tool reference
• API overview
• Webhooks
• FAQ: Use your own AI agent instead of Quinn