@superbryn-dev/mcp

SuperBryn MCP server: run the voice-agent eval loop from Claude Code, Claude Desktop, Codex, or Cursor:

configure agent → validate → generate scenarios → dial evals → read results → read report → fix prompt → repeat.

Seven tools. The server is a thin translator over the SuperBryn public API — every permission, tenancy, quota, and spend check is enforced server-side.

Quickstart

One command. It finds Claude Code, Codex, Cursor and Claude Desktop on your machine, connects each to SuperBryn, and installs the testing guide as a native skill. It asks for your API key (Settings → API keys in the dashboard) so the key never lands in shell history.

npx -y @superbryn-dev/mcp setup

Then open your AI tool and say: test my voice agent.

No Node, no terminal? Claude Desktop: download superbryn.mcpb, open it, paste your key in the dialog. It runs on Claude's bundled Node. Cursor: the dashboard's "Add to Cursor" button opens Cursor with the server pre-filled (Cursor still needs Node for npx). Both buttons sit right under a newly created key in the dashboard.

--only claude-code,codex,cursor,claude-desktop limits targets, --dry-run shows what would change, --key sbryn_... skips the prompt (for scripts). Claude Desktop needs a restart after.

By hand

claude mcp add superbryn --scope user --env SUPERBRYN_API_KEY=sbryn_... -- npx -y @superbryn-dev/mcp

Or as a plugin (MCP server and skill together; needs SUPERBRYN_API_KEY exported): /plugin marketplace add superbryndev/superbryn-mcp then /plugin install superbryn@superbryn.

[mcp_servers.superbryn]
command = "npx"
args = ["-y", "@superbryn-dev/mcp"]
env = { SUPERBRYN_API_KEY = "sbryn_..." }

{
  "mcpServers": {
    "superbryn": {
      "command": "npx",
      "args": ["-y", "@superbryn-dev/mcp"],
      "env": { "SUPERBRYN_API_KEY": "sbryn_..." }
    }
  }
}

In CI, pin the version (@superbryn-dev/[email protected]) instead of floating npx -y.

The guide

Every client gets the testing guide at connect time as MCP server instructions, so the loop works with no skill installed. The same file, skills/superbryn/SKILL.md, is what setup installs natively (Claude Code and Codex skills, a Cursor rule) and what the /superbryn:test-my-agent and /superbryn:test-my-prompt-change prompts follow. One source, so the guide cannot drift from the tools.

Tools

| Tool | Does | Scope needed | |---|---|---| | get_agent | Config, versions, paths, canonical count, coverage, readiness | agents:read | | configure_agent | Create agent · reconfigure · sync prompt (auto-version + re-derive flow/paths/policy) · set canonical paths | agents:write | | validate_agent | Free pre-flight, or full:true for the Ring-0 ceremony that dials one real call | scenarios:write | | generate_scenarios | Build the test suite across rings; list:true reads it (ids, ring, path) | scenarios:write | | run_evals | Dials real calls. dry_run:true (default) returns the cost estimate only | runs:execute | | get_runs | Batch progress · call list · one call's transcript + verdicts | runs:read | | get_report | Pass rate, metric breakdown, regressions vs previous version | reports:read |

Plus two prompts: /superbryn:test-my-agent (zero-knowledge path, creates the agent if needed) and /superbryn:test-my-prompt-change (re-test after a prompt edit).

generate_scenarios and run_evals refuse with agent_not_validated until validate_agent full:true has passed, because the dashboard hides scenarios and call logs for an unvalidated agent. Long tools hand back status:"generating" before your client's timeout; the work continues server side, poll rather than re-issue.

Environment

| Variable | Default | | |---|---|---| | SUPERBRYN_API_KEY | — | required | | SUPERBRYN_READ_ONLY | — | 1 drops every write tool |

Security posture

• Tools the key's scopes don't permit are still enforced server-side; ungranted capability fails with a clear re-issue hint.
• run_evals estimates by default, is annotated destructive (hosts ask the human), sends an idempotency key on dispatch (retries can never double-dial), and is capped by the key's server-side daily call budget.
• Transcripts are third-party speech: wrapped in untrusted-data markers with control characters stripped before they reach the model.
• Two runtime dependencies (@modelcontextprotocol/sdk, zod), no postinstall scripts.

Remote (Streamable HTTP)

npm run start:http serves /mcp (stateless, per-request credential via X-API-Key or Authorization: Bearer) and /healthz. Dockerfile included — deploys like any other SuperBryn ECS service.