---
title: Use MCP from Claude Desktop, Cursor and other clients
description: A step-by-step guide to using an MCP server through Veefore from Claude Desktop, Cursor, VS Code, Claude Code or n8n, with no code.
---

This guide takes you from a new Veefore account to an MCP client (Claude
Desktop, Cursor, VS Code, Claude Code, n8n) calling an MCP server's tools
through Veefore. You do not write any code, and you do not need a terminal
except for Claude Code.

The example uses [DeepWiki](https://mcp.deepwiki.com), a public MCP server that
answers questions about GitHub repositories. It needs no account or token, so
it is a good first server. Swap in your own server's URL as you go.

**You will need:** a Veefore account, about ten minutes, and the MCP client you
want to use. Claude Desktop also needs [Node.js](https://nodejs.org) installed,
because it reaches remote servers through a small helper.

:::note How it works
Your MCP client talks to Veefore as if Veefore were the MCP server. Veefore
checks every call against your rules, then calls the real server with the
server's own credential and passes the answer back. The client only ever sees
the tools you allowed.
:::

## Step by step

:::steps

:::step Sign in and pick the environment

Sign in at [console.veefore.com](https://console.veefore.com). At the top of the
page, the **Environment** switcher shows where you are working — for example
**Development**. Everything below is created in that environment, so pick it
now and keep it the same throughout.

A new account starts every environment in **Observe** mode: calls run and are
recorded, but nothing is blocked yet. Step 6 switches that on.
:::

:::step Connect the MCP server

1. In the left menu, open **MCP** (under *Connect*).
2. Click **Connect server**.
3. **Server URL:** paste the server's MCP address, for example
   `https://mcp.deepwiki.com/mcp`. The **Name** fills itself in; change it if
   you like.
4. **Access token:** leave it empty for DeepWiki. For a server that needs a
   token or API key, paste it here. Veefore stores it encrypted and sends it to
   the server for you; your MCP client never sees it.
5. Tick **I know who runs this server and trust it**.
6. Click **Connect**. If Veefore asks for your password again, enter it; this
   is a security check before switching a server on.

Veefore registers the server, asks it which tools it has, and switches it on.
No one can call anything yet.
:::

:::step Choose the agent and the tools

The next screen lists every tool the server offers.

1. **Agent:** Veefore calls whoever uses the tools an *agent*. Your MCP client
   will act as one agent. If the list is empty, type a name under **New agent
   name** — name it after the app, for example `Claude Desktop` — and click
   **Create agent**. It is ticked for you.
2. **Tools:** tools that only read are already ticked. Tools that change
   things, and tools rated **HIGH** or **CRITICAL**, are not. Read each one and
   tick only what you want the client to use. For DeepWiki, all three tools
   read and are ticked.
3. Click **Authorize N tools**.

Each tool gets a *capability* — a permission such as `mcp.deepwiki.read` —
which Veefore creates and gives to the agent. You can change all of this later
on the server's page.
:::

:::step Create an MCP key

1. Click **Open the server**. (Later, find it under **MCP** in the list.)
2. Scroll to **Use this server** and stay on the **MCP client (no code)** tab.
3. **1. The address** is the URL your client will use, for example
   `https://gateway.veefore.com/mcp/deepwiki`.
4. **2. The agent it acts as:** pick the agent from step 3.
5. **3. A key for the client:** type where the key will be used, for example
   `Cursor on my laptop`, and click **Create MCP key**.
6. Copy the key that appears (it starts with `vf_mcp_`). **It is shown only
   once.** If you lose it, create another and revoke the old one.

Use one key per app or device, so you can switch one off without the others.
:::

:::step Add Veefore to your client

Under **4. Paste it into your client**, pick your client. The key you just
created is already filled in; copy the block. Then follow the steps for your
client in [Set up your client](#set-up-your-client) below.
:::

:::step Turn on protection

While the environment is in **Observe** mode, every call runs, including ones
your rules would stop. Before relying on this for anything that matters:

1. **Add a policy.** Open **Policies**, click **New policy**, choose
   **Starter — safe defaults**, and click **Create draft**. On the policy's
   page, under **Bindings**, click **Add binding** and choose your workspace.
   Then click **Activate v1** and confirm.
2. **Switch to Enforce.** Open **Admin → Settings**. Under **Gateway
   enforcement**, choose **Enforce** and save.

With the starter policy, tools that read are allowed and tools flagged as high
impact wait for a person to approve them. See
[What your rules do](#what-your-rules-do) for the details.
:::

:::step Try it, and check it worked

Ask your client something that uses the server. With DeepWiki:

> Using DeepWiki, list the documentation topics for the
> modelcontextprotocol/typescript-sdk repository.

The client should call `read_wiki_structure` and show the topics.

Then open **Actions** in the console. The call is listed with the agent's
name, the tool (`mcp_deepwiki_read_wiki_structure`), the decision and the
time. Click it to see every check it went through. The server's page also
shows it under **Recent brokered calls**.
:::

:::

## Set up your client

Each block below is what the console gives you under **4. Paste it into your
client**, with `vf_mcp_…` standing in for your key and
`https://gateway.veefore.com/mcp/deepwiki` for your address.

:::tabs

:::tab Claude Desktop
1. Make sure [Node.js](https://nodejs.org) is installed.
2. Open Claude Desktop → **Settings** → **Developer** → **Edit Config**. This
   opens `claude_desktop_config.json`.
3. If the file is empty, paste the whole block. If it already has an
   `"mcpServers"` section, add only the `"veefore-deepwiki": { … }` part
   inside it, with a comma between entries.
4. Save the file and quit Claude Desktop completely, then open it again.
5. Start a new chat. The server and its tools appear in the chat's tools menu.

```json
{
  "mcpServers": {
    "veefore-deepwiki": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://gateway.veefore.com/mcp/deepwiki",
               "--header", "Authorization:${AUTH_HEADER}"],
      "env": { "AUTH_HEADER": "Bearer vf_mcp_…" }
    }
  }
}
```

`mcp-remote` connects Claude Desktop to a remote MCP server. The key is in
`env` so it works the same on Windows, macOS and Linux.
:::

:::tab Cursor
1. Open **Cursor Settings** → **MCP** → **Add new MCP server**. This opens
   `~/.cursor/mcp.json`. (For one project only, use `.cursor/mcp.json` in that
   project instead.)
2. Paste the block, or add the `"veefore-deepwiki"` entry to an existing
   `"mcpServers"` section.
3. Save. Back in **Cursor Settings → MCP**, the server shows a green dot and
   its tools.

```json
{
  "mcpServers": {
    "veefore-deepwiki": {
      "url": "https://gateway.veefore.com/mcp/deepwiki",
      "headers": { "Authorization": "Bearer vf_mcp_…" }
    }
  }
}
```
:::

:::tab VS Code
1. Open the Command Palette and run **MCP: Open User Configuration**. (For one
   project only, create `.vscode/mcp.json` in it instead.)
2. Paste the block, or add the `"veefore-deepwiki"` entry to an existing
   `"servers"` section.
3. Save, then click **Start** above the entry. Use the tools from Copilot Chat
   in **Agent** mode.

```json
{
  "servers": {
    "veefore-deepwiki": {
      "type": "http",
      "url": "https://gateway.veefore.com/mcp/deepwiki",
      "headers": { "Authorization": "Bearer vf_mcp_…" }
    }
  }
}
```
:::

:::tab Claude Code
Run this once in a terminal, then start `claude`. Check it with `claude mcp
list`.

```bash
claude mcp add --transport http veefore-deepwiki https://gateway.veefore.com/mcp/deepwiki \
  --header "Authorization: Bearer vf_mcp_…"
```
:::

:::tab n8n and other clients
Any client that speaks MCP over **Streamable HTTP** and can send a header works.
In n8n, add an **MCP Client Tool** node to your AI Agent, set the endpoint to
the address, choose the **HTTP Streamable** transport, and use **Bearer** or
**Header** authentication with your key. In general, a client needs:

```text
Server URL:   https://gateway.veefore.com/mcp/deepwiki
Transport:    Streamable HTTP
Header:       Authorization: Bearer vf_mcp_…
```
:::

:::

## What your rules do

What happens to a call depends on the environment's mode and your policy:

| Situation | What the client gets |
| --- | --- |
| **Observe** mode (a new account) | Every call runs and is recorded. Nothing is blocked. |
| **Enforce**, starter policy, a tool that reads | It runs. |
| **Enforce**, starter policy, a tool rated `HIGH` or `CRITICAL` | It waits for a person to approve it (see below). |
| **Enforce**, no policy at all | Ordinary tools run; tools whose capability is marked dangerous are blocked. |
| A rule says no | A message saying Veefore blocked it, and why. The server is not contacted. |

You can write your own rules for any tool. A tool's name in policy is
`mcp_<server>_<tool>`, for example `mcp_deepwiki_ask_wiki_question`. See
[Write your first policy](/build/first-policy).

## When a call needs approval

An MCP client cannot pause and come back later, so Veefore holds a call that
needs approval for up to **20 seconds**:

1. Someone opens **Approvals** in the console, checks the request, and clicks
   **Approve** or **Deny**.
2. If they decide within 20 seconds, the client gets the result (or is told it
   was denied) in the same reply.
3. If not, the client is told: *"This call is waiting for a person to approve it
   (approval apr_…). Nothing has been done yet."*
4. Once it is approved, ask the client to try again **with the same request**.
   Veefore finds the approval and runs the call — once. Asking again before it
   is approved does not open a second request.

## Manage keys

Open the server's page → **Use this server** → **MCP client**, and pick the
agent. Its keys are listed with when each was last used.

- **Revoke** a key to stop that client immediately. Its next call fails.
- **Lost a key?** Keys are stored only as a hash and cannot be shown again.
  Create a new one, paste it into the client, then revoke the old one.
- **Revoking the agent** (on its **Agents** page) stops every key it has.

Creating and revoking keys needs the `agent:rotate_credentials` permission. A
key only works on Veefore's `/mcp/…` address; it cannot be used for anything
else in Veefore.

## Add more servers

Repeat steps 2 to 5 for each server. Each server has its own address
(`…/mcp/<server>`), so each is a separate entry in your client's config. The
same agent and key can be used for all of them; the agent only sees the tools
you authorized for it on each server.

## Something not working?

See [MCP troubleshooting](/build/mcp-troubleshooting) for every message you
might see and how to fix it.

## Related

:::cards

:::card MCP overview | /build/mcp
How Veefore handles MCP servers, and the other ways to use them.
:::

:::card Call MCP tools from code | /build/mcp-sdk
For an agent you write yourself.
:::

:::card MCP troubleshooting | /build/mcp-troubleshooting
Every error message, and what to do.
:::

:::