# MCP server

| | |
|---|---|
| Endpoint | `https://app.optbench.com/mcp` |
| Transport | Streamable HTTP |
| Auth | OAuth 2.1, or a workspace key |
| Prompt | `scan_repo` (`/mcp__optbench__scan_repo` in Claude Code) |

Every dashboard action has an MCP tool, and both call the same code. Tool names start with `biy_` (the protocol ids from before OptBench's rename; they stay so connected agents keep working). The full list: [Tools](/docs/tools).

## Sign in with OAuth (recommended)

Add the server without a key. On the first call it answers `401` with its OAuth metadata (RFC 9728); your client opens the browser, you sign in to OptBench and approve. Access tokens last one hour and your client refreshes them. You see and revoke connected apps in the dashboard under **Agents → Connected apps**.

## Or use a workspace key

For CI, headless runs and clients without OAuth. An Admin creates the key in the dashboard under **Agents → Use a key instead**; it is shown once. Keys start with `optbench_` (keys from before the rename, `biy_…`, still work). Send it as a header:

```text
Authorization: Bearer optbench_…
```

Keep it in an environment variable, never in a committed file. One key per workspace: replacing it disconnects every agent that uses the old one. (Keys starting with `optbench_ingest_` are for sending OpenTelemetry traces, not for MCP.)

## What an agent may do

There are no scopes yet. OAuth and a key both give the agent the same access as you in that workspace: read, edit, delete and start runs. Two guards hold for every agent:

- **Nothing spends money silently.** Tools that run paid model calls (`biy_runs_start`, `biy_runs_extend`, `biy_cases_gold_generate`) need `confirm_cost_usd` taken from an estimate the user agreed to; without it they only estimate. The [Tools](/docs/tools) page marks them "spends".
- **Secrets never pass through the agent.** Provider keys and data connections are added in the dashboard only.

Deletes are marked destructive, and `biy_use_cases_delete` asks for `confirm: true`.

## Workspaces

A key belongs to one workspace. With OAuth, `biy_workspaces_list` shows your workspaces and `biy_workspaces_switch` picks the one later calls use.