MCP for coding agents

Connect with OAuth

Use the same endpoint in every client. Your browser opens BoringCache so you can sign in, choose an account or one workspace, and approve read-only access. You never paste an OAuth token into the client.

codex mcp add boringcache --url https://api.boringcache.com/v2/mcp
codex mcp login boringcache

claude mcp add --transport http boringcache https://api.boringcache.com/v2/mcp

Other clients should use the Streamable HTTP URL https://api.boringcache.com/v2/mcp with OAuth enabled.

Account and workspace access

Agents can call boringcache_list_workspaces when the right workspace is not already clear. Every other tool requires an exact namespace/workspace path, and BoringCache checks current membership and workspace availability on each call.

Manual tokens

Use a manual MCP token for a script or client that cannot complete browser OAuth. Create it from the token page, keep it in an environment variable, and use the same endpoint.

export BORINGCACHE_MCP_TOKEN=YOUR_TOKEN_HERE
codex mcp add boringcache --url https://api.boringcache.com/v2/mcp   --bearer-token-env-var BORINGCACHE_MCP_TOKEN

Security

• The hosted MCP catalog is read-only. It cannot save, delete, or administer caches.
• OAuth access tokens are short-lived, refresh tokens rotate, and replay revokes the complete connection.
• For an organization that requires SSO, sign in through its identity provider before connecting. The MCP connection expires with the organization SSO grant, up to eight hours; sign in and reconnect after expiry. See organization SSO.
• Changing organization membership or revoking a connected agent takes effect without waiting for an authorization cache.
• Workspace feature changes are bounded by a five-second enabled-cache lifetime and are checked again before workspace data is read.
• Review or revoke browser connections from Connected agents.