MCP server
The HotCodePush MCP server at mcp.hotcodepush.com, its sign-in through OAuth or an API token, the toolsets, the client setup and the troubleshooting.
HotCodePush runs an MCP server at https://mcp.hotcodepush.com/mcp. Its tools search these docs and manage your organizations, apps, channels, bundles and releases through the REST API, doing exactly what the signed-in person may.
- Tools lists every tool by toolset with the parameters that locate its object, and which ones an API token or
readonly=truekeeps.
The endpoint
https://mcp.hotcodepush.com/mcpThe endpoint speaks the streamable HTTP transport of the Model Context Protocol. Any client that connects to a remote server over HTTP connects to it. Uploading a bundle stays with the CLI. create_release releases what was uploaded.
A failed call comes back as a result the model reads, never as a protocol error.
Sign in
Both credentials go in Authorization: Bearer <token> and are forwarded to the API unchanged. The server stores nothing, so revoking a token in the console cuts the client off at once.
OAuth for a client with a browser
A client that handles the 401 challenge signs in on the bare endpoint, with no query. The challenge names the protected-resource metadata, https://api.hotcodepush.com/.well-known/oauth-protected-resource/mcp, and the scopes to ask for, mcp and offline_access. The client opens the browser, and the console's consent page asks once whether the client may act as you.
The client then holds an access token, hcp_oat_…, and a refresh token, so an expired access token is refreshed without the consent page again.
An API token for a headless client
A script, a pipeline or a client with no browser sends an API token, hcp_…, the same token the REST API takes:
- Open Settings › API tokens.
- Create a token with a name and an expiry, 30 days by default.
- Copy it once, into the client's configuration and nowhere else, since the console never shows it again.
The tools that act where the API allows a person alone register for an OAuth access token only. Tools lists them.
A token is the account
An API token acts as you. Keep it in a user-level configuration or a secret store, never in a tracked file, and revoke it if it may have leaked. Everything a tool is given reaches your AI provider.
Set up a client
The token blocks select the docs, organization, app, channel, bundle and release toolsets. Replace them with yours, or drop the query for every toolset.
Run this in the project, or with --scope user for every project:
claude mcp add --transport http hotcodepush "https://mcp.hotcodepush.com/mcp"Then run /mcp in Claude Code and choose hotcodepush to sign in, and the browser opens the consent page.
With an API token, add the header and the toolsets. Never pass --scope project with a token, since that scope writes the server into the project's .mcp.json:
claude mcp add --transport http hotcodepush "https://mcp.hotcodepush.com/mcp?toolsets=docs,organization,app,channel,bundle,release" --header "Authorization: Bearer hcp_YOUR_TOKEN"Any other client takes transport HTTP, the URL and one of the two sign-ins. A token's toolsets go on the URL.
To check it works, ask the agent "Which channels does my app have?" and watch it run list_organizations, list_apps and list_channels.
Toolsets
The tools come in fourteen toolsets, docs and one per resource. Tools lists every toolset and its tools. The endpoint's query selects them:
| Query | Effect |
|---|---|
| none | Registers every toolset. |
?toolsets=docs,app,channel,release | Registers the named toolsets. A name the server does not know is ignored, and a list naming none it knows selects every toolset. |
?toolsets=docs | Registers the docs toolset alone, which needs no token. |
readonly=true | Drops every tool that writes or deletes. Any other value answers 400 validation. |
An OAuth client takes the bare endpoint and gets every toolset, while the selection and readonly=true go on the URL with an API token only. Name the toolsets a session needs, keep readonly=true for a shared or unattended setup, and quote the URL on a command line.
Troubleshooting
A 401 before any tool runs
A request without a bearer is refused before the protocol starts, unless it selects ?toolsets=docs alone. The answer is 401 unauthenticated with a WWW-Authenticate challenge, which an OAuth client follows to the consent page. A client that handles no challenge needs the API token in its Authorization header: Bearer, one space, the 40 characters starting with hcp_.
A 401 on a tool call
A token the API refuses, expired, revoked or malformed, turns the call into the same 401. An OAuth client refreshes its access token and repeats the call. With an API token, create a new one on Settings › API tokens and replace it in the client's configuration.
client_update_required
The tool answers client_update_required: <message>. Nothing in your client is out of date: the version named is the hosted server's. Try again later, and write to support@hotcodepush.com if it persists.
429 from the docs toolset
search_docs and get_doc_page verify no token, so a request that selects the docs toolset, the default selection included, is counted by IP address, 600 a minute. Past the limit the server answers 429 with Retry-After: 60: wait a minute. A request that names the account toolsets without docs is limited by the token instead, as the rate limits say.
A tool the API refused
The server turns the API's codes it meets most into a sentence with its fix, and passes every other code through as <code>: <message>:
| The result begins with | The API answered | What to do |
|---|---|---|
Not allowed: | 403 forbidden | The token's user holds a role below the operation's. Organizations says which it needs. |
Not found: | 404 not_found | The id is wrong, or belongs to an organization the user is no member of. Resolve it again through the list tool. |
Invalid request: | 400 validation, the details naming the field | Fix the parameter the details name. |
Rate limit reached. | 429 rate_limited | Wait a minute. A call the server retried adds The call was already retried. |
The HotCodePush api is under maintenance. | 503 maintenance | Try again in a few minutes. |
The HotCodePush api is temporarily unavailable. | 500 internal, or an answer outside the API's shape | Try again later. A call the server retried says so. |
An unexpected error occurred. Please try again. | nothing, since the error is the server's own and is reported | Try again. |
channel_protected:, bundle_in_use:, plan_required: and every other code | the code's own status | The message names the cause, and the API errors give the code's meaning. |
The server retries only where a repeat is safe. Reads, deletes, pauses, resumes and the domain verification go up to three times on a timeout, a network error, a 408, a 429 or a 5xx. A creating tool sends an Idempotency-Key, so a retried create answers the first result, while an update, the app transfer and the revoke are sent once.
A call the server retried adds The call was already retried. to its result. A write that timed out may still have happened, so read the object before repeating the call.
A tool missing from the list
A tool the client does not list was not registered for the request, for one of three reasons, the most frequent first:
- The URL selects other toolsets. Add the toolset's name to
?toolsets=, or drop the query for every toolset. readonly=truedropped it. The writes and the destructive tools go, and each section of Tools names its reads.- The request carried an API token. Fourteen tools register for an OAuth access token only. Tools lists them. Sign the client in through OAuth.
Last updated on