---
title: Claude, Cursor and VS Code
description: Connect Claude Code, Claude Desktop, claude.ai, Cursor or VS Code to Veefore with an MCP key, and use Veefore's control tools.
---
MCP clients reach Veefore at one of two addresses, both with an **MCP key**:

| Address | What the client gets |
| --- | --- |
| `https://gateway.veefore.com/mcp` | Veefore's own tools: list, authorize, execute, status and recent actions for the agent's Veefore tools. |
| `https://gateway.veefore.com/mcp/<server>` | The authorized tools of one MCP server Veefore brokers. See [Use MCP from a client](/build/mcp-client). |

This guide uses `/mcp`. Do the [shared setup](/build/connect-agents) first:
an agent, a tool, a policy, enforcement on.

## Step by step

:::steps
:::step Create an MCP key for the agent
**Agents → your agent → MCP keys → Create**. Name it after the client
("Claude Code on my laptop"). Copy the key, which starts `vf_mcp_`. It is shown
once and stored only as a hash.

The key works on the `/mcp` endpoints only, acts as exactly this agent, and
adds no authority of its own. Revoke it on the same page at any time.
:::
:::step Register the client
**Integrations → Claude and MCP clients → Add**, choose the same agent. Its
status turns **Connected** after the first call.
:::
:::step Add Veefore to your client
Use the tab for your client below.
:::
:::step Try it
Ask the assistant: *"List my Veefore tools, then check whether you may send an
email to ops@example.com."* It calls `veefore_list_tools`, then
`veefore_authorize`. Ask it to send, and it calls `veefore_execute`.
:::
:::step Check it
The call is on **Actions** with its decision, and in **Audit** with
`via: mcp_control`.
:::
:::

:::tabs
:::tab Claude Code
```bash
claude mcp add --transport http veefore https://gateway.veefore.com/mcp \
  --header "Authorization: Bearer vf_mcp_…"
```
Check with `claude mcp list`, then start `claude`.
:::
:::tab Claude Desktop
**Settings → Developer → Edit Config** opens `claude_desktop_config.json`. Add
the entry, save, and restart Claude Desktop. Needs [Node.js](https://nodejs.org).
```json
{
  "mcpServers": {
    "veefore": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://gateway.veefore.com/mcp",
               "--header", "Authorization:${AUTH_HEADER}"],
      "env": { "AUTH_HEADER": "Bearer vf_mcp_…" }
    }
  }
}
```
:::
:::tab Cursor
**Cursor Settings → MCP → Add new MCP server** (`~/.cursor/mcp.json`):
```json
{
  "mcpServers": {
    "veefore": {
      "url": "https://gateway.veefore.com/mcp",
      "headers": { "Authorization": "Bearer vf_mcp_…" }
    }
  }
}
```
:::
:::tab VS Code
Command Palette → **MCP: Open User Configuration**:
```json
{
  "servers": {
    "veefore": {
      "type": "http",
      "url": "https://gateway.veefore.com/mcp",
      "headers": { "Authorization": "Bearer vf_mcp_…" }
    }
  }
}
```
:::
:::tab claude.ai
An organization **Owner** adds it under **Organization settings → Connectors →
Add → Custom**, with the URL `https://gateway.veefore.com/mcp` and a request
header `Authorization: Bearer vf_mcp_…`.

The request-header option is an Anthropic beta available to a limited set of
organizations. If your dialog shows no request headers, it is not available to
you yet. claude.ai's default sign-in for connectors is OAuth, which Veefore does
not offer for MCP: use Claude Code, Claude Desktop, Cursor or VS Code instead.

The header is the organization's key, so every member's calls act as the same
agent.
:::
:::

## The tools

| Tool | What it does |
| --- | --- |
| `veefore_list_tools` | The Veefore tools this agent may attempt. |
| `veefore_authorize` | Asks whether a request would be allowed. Nothing runs. On ALLOW it returns an `authorization_id` valid for 120 seconds, for exactly those parameters, once. |
| `veefore_execute` | Runs the request through policy, risk, approval and the credential broker. Pass `authorization_id` from `veefore_authorize`, or `approval_id` once a person approved. |
| `veefore_action_status` | The outcome of one of the agent's actions, or the status of an approval. |
| `veefore_recent_actions` | The agent's last actions and outcomes. |

When a person must approve, `veefore_execute` answers with the approval id and
does nothing. Approve it under **Approvals**, then ask the assistant to run it
again: it calls `veefore_execute` with the same arguments and `approval_id`.

## What Veefore cannot see

A connector added directly in the client (a Gmail connector in Claude, a
GitHub MCP server in Cursor) acts without Veefore. That is why this runtime is
**Partial** at best. Keep the actions you need controlled behind Veefore tools,
and remove the direct connectors that duplicate them.

## Troubleshooting

| Symptom | Fix |
| --- | --- |
| `Send the agent's MCP key as "Authorization: Bearer vf_mcp_…"` | The header is missing or misspelled. |
| `This MCP key is not valid` | Revoked, expired, or the agent's identity was revoked. Create a new key. |
| `veefore_list_tools` returns nothing | The agent is not authorized on any active tool in its environment. |
| Every execute is refused | Check the policy on **Actions**; in **Observe** nothing is refused, in **Enforce** the reason is shown. |
| The runtime stays **Pending** | Veefore has not seen the agent yet. Make one call. |