Connect from Claude Code, Codex, Cursor

To add the Isolation MCP server to Claude Code, Codex, Cursor or Claude Desktop, point the client at https://mcp.isolation.cloud/mcp. The server speaks Streamable HTTP and uses OAuth: the first call gets a 401, the client opens your browser, you sign in to Isolation, pick an organization and approve what the client may do. From then on the agent in your editor can do what you can do on the website: launch a session, open a web preview, share its link, read the logs, stop it.

Claude Code

claude mcp add --transport http isolation https://mcp.isolation.cloud/mcp

Type /mcp in Claude Code, pick isolation and follow the sign-in. The consent screen shows which organization you are granting and which rights; see OAuth, scopes and access tokens.

Cursor

In .cursor/mcp.json (one project) or ~/.cursor/mcp.json (every project):

{
  "mcpServers": {
    "isolation": {
      "url": "https://mcp.isolation.cloud/mcp"
    }
  }
}

Cursor lists the server under MCP settings with a sign-in link. After you approve, the tools appear in the agent's tool list.

Codex

In ~/.codex/config.toml:

[mcp_servers.isolation]
url = "https://mcp.isolation.cloud/mcp"

Codex runs the OAuth sign-in the first time it starts a conversation that uses the server.

Claude Desktop

Open Settings, then Connectors, then Add custom connector. Name it Isolation and paste https://mcp.isolation.cloud/mcp. Claude Desktop opens the consent screen in your browser. The app you approve is what the activity log shows as the channel for every call it makes.

A client that takes a command

Some hosts configure a command and environment rather than a URL: goose, a Buzz agent, an older desktop config file, a script. For those, mint an access token on the MCP page in Isolation (Connected apps, then Connect with an access token: give it a name, choose the rights, choose an expiry) and run the isolation-mcp bridge:

{
  "mcpServers": {
    "isolation": {
      "command": "npx",
      "args": ["-y", "isolation-mcp"],
      "env": { "ISOLATION_TOKEN": "isomcp_…" }
    }
  }
}

npx isolation-mcp reads JSON-RPC on stdin, posts each message to the MCP with your token, and writes the answer to stdout. It stores nothing and logs only to stderr. Node 20 or newer is all it needs. ISOLATION_MCP_URL overrides the endpoint for a self-hosted deployment. The token is shown once; revoke it from the same page to cut the bridge off.

A worked example

Ask the agent in your editor: "Launch my web workspace on the office server, show me the preview, and send me the link." This is what it calls, in order.

1. org_status. Who you are, your role, the organization's servers and your running sessions. The server's instructions tell the agent to start here.
2. session_launch with workspaceId, environment and serverId. This one can take a while, so the MCP answers it over a stream with progress notifications: cloning the repos, loading the environment, starting the views. The result carries the new session's id.
3. view_create with type: "web" and url: "http://localhost:3000". A web view publishes what the session serves on that port at a public address.
4. view_link with the view's id. The answer is the public link, https://<slug>.isolation.cc, whose random suffix is the access secret. The agent pastes it into the chat.
5. session_logs with tail: 100 if the preview does not load: the sandbox's boot output, what the clone did, why something failed.
6. session_save, then session_stop with the session's id when you are done. Stopping destroys the sandbox; saving first commits the work to the workspace's own branch.

Every call is logged with your name, the tool, the client and the outcome, so a teammate reading the activity log sees "Claude Code launched web on office-1" rather than "an API call".

What the agent sees

tools/list returns only the tools the token's rights allow, so an agent connected with the read-only default sees the lists and status tools and none of the launch or stop tools. A refused call comes back as a tool result the agent can read and adapt to, never as a protocol error. The full list, with who may call each one, is on what an external agent can do.

The MCP is stateless: one POST, one JSON-RPC message, one answer. There is no session to resume and nothing kept between calls, so a redeploy in the middle of a conversation loses nothing. GitHub, Slack, Linear and the other apps reach the same actions through their own commands; see commands reference.