# Upvera MCP server

The Upvera MCP server lets an AI client read your own Upvera data, leave drafts in your Hatch and prepare posts that you publish yourself. Your agent can see your startups, your recent commits and your proof sources, then write a progress post. In Claude and ChatGPT the results show up as Upvera cards. The agent never publishes on its own: a post goes out only when you press Publish.

```text
https://mcp.upvera.co/mcp
```

## What it can do

| Tool | What it does | Access |
|---|---|---|
| `upvera_whoami` | The account this connection acts for: handle, display name, profile URL and plan | read |
| `list_my_startups` | Startups you own or belong to, with your role and last post date | read |
| `get_startup_status` | One of your startups: recent posts, proof sources and their verification, public value with its latest receipt | read |
| `get_build_trail` | Recent commits from your connected repositories, up to 30 days back | read |
| `create_draft` | Saves a draft to Hatch, optionally tied to a commit and a startup | writes a draft |
| `prepare_post` | Prepares a post and shows it in a preview card, exactly as it will appear on Upvera | prepares, never publishes |
| `publish_post` · `undo_post` | Run only from the preview card when you press Publish or Undo. The model cannot see or call them | card only, rolling out |

Inputs and outputs for each tool are on the [Tools](/mcp/tools/) page.

## Interactive cards

Clients that support MCP Apps (Claude on the web, desktop and mobile, and ChatGPT) show each result as an Upvera card: your startup with its Upvera Value, seven-day change and latest receipt, your build trail, a saved draft, and the post preview. The numbers come from Upvera's servers and are formatted the same way as in the app. Other clients get the same data as text.

## Publishing a prepared post

1. The assistant calls `prepare_post`. The card shows the post as it will appear, with the startup and the kind. The text is locked on Upvera's side, so what you see is what gets published.
2. You press **Publish** in the card. The card calls `publish_post`, and your client may ask you to approve that call too.
3. For 10 minutes the card offers **Undo**.

Your first post from an assistant, a post with a link or an @mention, and every post while posting from assistants is switched off, are confirmed on Upvera's own compose screen instead: the card shows **Confirm in Upvera** and opens it with the text filled in. Posting from the card is rolling out; until it is switched on, every prepared post takes that path.

## Connect your client

The server speaks Streamable HTTP. Add the URL above to your client, then sign in with your Upvera account the first time a tool runs.

- [Claude Code](/mcp/claude-code/): one `claude mcp add` command
- [Claude](/mcp/claude/): a custom connector in Settings
- [Cursor](/mcp/cursor/): an entry in `mcp.json`
- [VS Code](/mcp/vscode/): an entry in `.vscode/mcp.json`
- [ChatGPT](/mcp/chatgpt/): a connector in developer mode

## Sign-in and scopes

There is no API key. The server runs its own OAuth 2.1 authorization server with PKCE (S256). Clients register through a Client ID Metadata Document or Dynamic Client Registration, and both are supported. You sign in on app.upvera.co, then approve the connection on a consent page that lists exactly what the client can and cannot do.

| Scope | Grants |
|---|---|
| `read:own` | The four read tools, for your own data only |
| `write:drafts` | `create_draft` and `prepare_post`: drafts and previews, never published by themselves |
| `publish:posts` | Optional. Lets the preview card publish and undo a post you prepared. Off unless you tick **Also allow posting** on the consent page; a client cannot request it |
| `offline_access` | A refresh token, so you stay connected |

`read:own` and `write:drafts` are requested together. Access tokens live for one hour. Refresh tokens live for 30 days and rotate on every use.

## What it will never do

- Touch money. There is no tool for UPV, wings, the wallet or withdrawals, and no tool returns a balance.
- Read anyone else's data. Every tool works only on the account that signed in.
- Read your direct messages, who gave you Prime or Pass, unpublished posts or Hatch notes.
- Publish without you. The model has no publish tool. A prepared post goes out only when you press Publish in its card or publish it on Upvera's own compose screen.

## Limits

| Limit | Value |
|---|---|
| Reads | 60 per minute per account |
| Drafts and previews | 10 per minute, and 20 drafts per day, per account |
| Posts from the card | 3 per day per account, undo within 10 minutes |

A tool that hits a limit answers with a short message asking you to wait a minute. It does not fail the whole session.

## Revoke a connection

Open [Settings › Security › AI access](https://app.upvera.co/settings/security/ai-access) on app.upvera.co. Each connected client is listed with its scopes. Revoking one ends its tokens immediately.

## Discovery

Clients find the authorization server from the protected resource metadata:

```bash
curl -s https://mcp.upvera.co/.well-known/oauth-protected-resource/mcp
```

```json
{
  "resource": "https://mcp.upvera.co/mcp",
  "authorization_servers": ["https://mcp.upvera.co"],
  "scopes_supported": ["read:own", "write:drafts"],
  "bearer_methods_supported": ["header"]
}
```

A request to `/mcp` without a token answers `401` with a `WWW-Authenticate` header that points to this document.

---
Source: https://upvera.dev/mcp/ · Markdown: https://upvera.dev/mcp.md