Claude, Cursor and VS Code

Connect Claude Code, Claude Desktop, claude.ai, Cursor or VS Code to Veefore with an MCP key, and use Veefore's control tools.

MCP clients reach Veefore at one of two addresses, both with an MCP key:

Address	What the client gets
`https://gateway.veefore.com/mcp`	Veefore's own tools: list, authorize, execute, status and recent actions for the agent's Veefore tools.
`https://gateway.veefore.com/mcp/<server>`	The authorized tools of one MCP server Veefore brokers. See Use MCP from a client.

This guide uses /mcp. Do the shared setup first: an agent, a tool, a policy, enforcement on.

#Step by step

Create an MCP key for the agent

Agents → your agent → MCP keys → Create. Name it after the client ("Claude Code on my laptop"). Copy the key, which starts vf_mcp_. It is shown once and stored only as a hash.

The key works on the /mcp endpoints only, acts as exactly this agent, and adds no authority of its own. Revoke it on the same page at any time.

Integrations → Claude and MCP clients → Add, choose the same agent. Its status turns Connected after the first call.

Add Veefore to your client

Use the tab for your client below.

Try it

Ask the assistant: "List my Veefore tools, then check whether you may send an email to ops@example.com." It calls veefore_list_tools, then veefore_authorize. Ask it to send, and it calls veefore_execute.

Check it

The call is on Actions with its decision, and in Audit with via: mcp_control.

bash
claude mcp add --transport http veefore https://gateway.veefore.com/mcp \
  --header "Authorization: Bearer vf_mcp_…"

Check with claude mcp list, then start claude.

Settings → Developer → Edit Config opens claude_desktop_config.json. Add the entry, save, and restart Claude Desktop. Needs Node.js.

json
{
  "mcpServers": {
    "veefore": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://gateway.veefore.com/mcp",
               "--header", "Authorization:${AUTH_HEADER}"],
      "env": { "AUTH_HEADER": "Bearer vf_mcp_…" }
    }
  }
}

Cursor Settings → MCP → Add new MCP server (~/.cursor/mcp.json):

json
{
  "mcpServers": {
    "veefore": {
      "url": "https://gateway.veefore.com/mcp",
      "headers": { "Authorization": "Bearer vf_mcp_…" }
    }
  }
}

Command Palette → MCP: Open User Configuration:

json
{
  "servers": {
    "veefore": {
      "type": "http",
      "url": "https://gateway.veefore.com/mcp",
      "headers": { "Authorization": "Bearer vf_mcp_…" }
    }
  }
}

An organization Owner adds it under Organization settings → Connectors → Add → Custom, with the URL https://gateway.veefore.com/mcp and a request header Authorization: Bearer vf_mcp_….

The request-header option is an Anthropic beta available to a limited set of organizations. If your dialog shows no request headers, it is not available to you yet. claude.ai's default sign-in for connectors is OAuth, which Veefore does not offer for MCP: use Claude Code, Claude Desktop, Cursor or VS Code instead.

The header is the organization's key, so every member's calls act as the same agent.

#The tools

Tool	What it does
`veefore_list_tools`	The Veefore tools this agent may attempt.
`veefore_authorize`	Asks whether a request would be allowed. Nothing runs. On ALLOW it returns an `authorization_id` valid for 120 seconds, for exactly those parameters, once.
`veefore_execute`	Runs the request through policy, risk, approval and the credential broker. Pass `authorization_id` from `veefore_authorize`, or `approval_id` once a person approved.
`veefore_action_status`	The outcome of one of the agent's actions, or the status of an approval.
`veefore_recent_actions`	The agent's last actions and outcomes.

When a person must approve, veefore_execute answers with the approval id and does nothing. Approve it under Approvals, then ask the assistant to run it again: it calls veefore_execute with the same arguments and approval_id.

#What Veefore cannot see

A connector added directly in the client (a Gmail connector in Claude, a GitHub MCP server in Cursor) acts without Veefore. That is why this runtime is Partial at best. Keep the actions you need controlled behind Veefore tools, and remove the direct connectors that duplicate them.

#Troubleshooting

Symptom	Fix
`Send the agent's MCP key as "Authorization: Bearer vf_mcp_…"`	The header is missing or misspelled.
`This MCP key is not valid`	Revoked, expired, or the agent's identity was revoked. Create a new key.
`veefore_list_tools` returns nothing	The agent is not authorized on any active tool in its environment.
Every execute is refused	Check the policy on Actions; in Observe nothing is refused, in Enforce the reason is shown.
The runtime stays Pending	Veefore has not seen the agent yet. Make one call.