@sarcio/mcp

Work with Sarcio from Claude, or any other Model Context Protocol client.

Triage the bug reports your visitors filed, see what an AI-drafted fix actually changes, preview it on your real site, and check what is patched in production — without leaving the assistant you already work in. When a fix is right, you get the link to approve it; the approval itself stays with you.

You sign in as yourself, so the assistant sees exactly what your own account sees in your workspace, and everything it does is in the audit log under your name.

Requirements

• Node.js 24.21 or later (npx comes with it).
• A Sarcio workspace, and a member account in it. Your workspace address is https://<your-workspace>.sarcio.io — the address you sign in at.

Setup

Claude Code

claude mcp add --transport stdio \
  --env SARCIO_WORKSPACE_URL=https://acme.sarcio.io \
  sarcio -- npx -y @sarcio/mcp

Claude Desktop

In claude_desktop_config.json, then restart Claude Desktop:

{
  "mcpServers": {
    "sarcio": {
      "command": "npx",
      "args": ["-y", "@sarcio/mcp"],
      "env": { "SARCIO_WORKSPACE_URL": "https://acme.sarcio.io" }
    }
  }
}

Any other MCP client

Run npx -y @sarcio/mcp as a stdio server with SARCIO_WORKSPACE_URL in its environment.

Signing in

1. Sign in to your workspace in your browser as usual.
2. Ask the assistant to sign in to Sarcio. It gives you a link.
3. Open the link in that browser, check the permissions, and approve.

That is it: the sign-in is remembered on this machine and renews itself. After 30 days unused you are asked again, with a warning beforehand. Open the link on the same computer the MCP server runs on — it finishes on a local address.

The sign-in asks only for what the tools use: reading reports, patches, sites, members, integrations, billing and the audit log, and acting on patches.

Using an API token instead

For a headless setup, an admin can create a pat_ API token on the dashboard's API tokens page and set it alongside the workspace address:

"env": {
  "SARCIO_WORKSPACE_URL": "https://acme.sarcio.io",
  "SARCIO_API_TOKEN": "pat_..."
}

A token is not a person, so it reaches less: reports, patches (read, reject, retire, redraft, retry a pull request), sites and the audit log, as its scopes allow. Previews, live and orphaned patch lists, members, integrations and billing need the browser sign-in. The token is only ever sent to SARCIO_WORKSPACE_URL.

What you can do

Two ready-made workflows appear in your client's prompt picker: Triage the Sarcio inbox and Review live Sarcio patches. Or ask in your own words — "what did visitors report on the Meridian site today?", "why didn't the fix PR for this patch open?".

| Tool | What it does | Who | | ------------------------------ | --------------------------------------------------------------------- | ------ | | sarcio_login / _logout | Sign in to a workspace as yourself, or forget the sign-in | Anyone | | sarcio_status | Which workspace, how you are signed in, when it needs renewing | Anyone | | sarcio_list_reports | The report inbox, filtered by status, a page at a time | Member | | sarcio_get_report | One report with captured console/network context and its patches | Member | | sarcio_regenerate_patch | Redraft a fix, optionally with a steering note (uses AI credits) | Member | | sarcio_get_patch | A patch's ops, risk rating, approvals, expiry and fix PR | Member | | sarcio_preview_patch | A link that applies a draft for you alone | Member | | sarcio_approve_patch | What approving will do, and the dashboard link to approve it | Member | | sarcio_reject_patch | Reject a patch that is not live yet | Member | | sarcio_retire_patch | Take a live patch down for every visitor | Member | | sarcio_retry_pull_request | Reopen a failed fix PR (API token), or link to it (sign-in) | Member | | sarcio_list_live_patches | Everything live in production | Member | | sarcio_list_orphaned_patches | Live patches whose permanent fix is no longer on the way | Member | | sarcio_sites_summary | Sites with their repo and how many patches are live on each | Member | | sarcio_get_site | One site's repository, source paths, module and remote-build settings | Member | | sarcio_site_active_patches | The signed patches one site is serving right now | Member | | sarcio_get_site_ticketing | How a site mirrors patches into Jira | Admin | | sarcio_list_members | Members, roles and two-factor status | Admin | | sarcio_audit_log | The workspace's audit trail | Admin | | sarcio_workspace | Workspace name, slug and billing status | Member | | sarcio_subscription | Plan, usage and this month's AI credits | Admin | | sarcio_list_integrations | GitHub/GitLab/Bitbucket/Jira connections and their warnings | Admin | | sarcio_signing_key | The public key clients verify patches against | Admin |

Rejecting, retiring, redrafting and retrying a PR act on your real workspace; the assistant is told to confirm with you first.

Approving stays with you

Sarcio only accepts an approval from a person signed in to the dashboard. When you approve you rate the risk: a low-risk fix goes live at once; a higher-risk one waits for a second, different member to approve too. An assistant approving on your behalf would defeat that, so sarcio_approve_patch explains the choice and hands you the link to the report page instead.

What it deliberately cannot do

No sites, members, integrations, API tokens, sidecar keys, signing keys, writing instructions or billing changes — those stay in the dashboard. Bug reports are written by anonymous visitors to your site, and an assistant that reads them should not be able to be talked into changing who has access.

Troubleshooting

• "not a Sarcio workspace address" — use https://<your-workspace>.sarcio.io, not www.sarcio.io or dashboard.sarcio.io.
• "Sign in first" in the browser — sign in to the workspace in that browser, then open the link again.
• 401 — the sign-in lapsed or the API token was revoked; sign in again.
• 403 — your role cannot do that (admins manage the workspace), the action is dashboard-only, or the workspace is locked for an unpaid balance.
• 402 — the workspace's AI credits for the month are spent. Retrying does not help; an admin can add credits or change plan.
• 429 — rate limited; wait the time given.

Documentation

The full guide, with screenshots of the sign-in, is at https://www.sarcio.io/docs/mcp.

License

Business Source License 1.1 (the LICENSE file in this package). You may use it in production to connect your own applications and assistants to Sarcio under an active subscription or trial. Each version converts to Apache-2.0 on its Change Date.