MCP server

The Voidhash MCP server lets an AI agent work in your projects: answer support questions about a person's access, manage products and store mappings, design and deploy paywalls, run flags and A/B tests, read revenue and ad performance, debug webhooks and manage your team. It signs in as you, so there is no key to copy, and changes that can't be undone wait for your agreement.

The server runs at:

https://api.voidhash.com/api/mcp

It uses streamable HTTP and the stateless MCP protocol, version 2026-07-28. Clients that support only the older session-based versions can't connect. On a self-hosted instance, use your API server's address followed by /api/mcp.

Connect your agent

In Studio, Connect an agent walks you through the steps for one agent. You find it on Settings → API keys and in Personal settings → Devices and apps. With the CLI built, voidhash mcp install finds Claude Code, Cursor, Codex, VS Code and Claude Desktop on your computer and adds the server to the ones you choose. To add the server by hand:

claude mcp add --transport http voidhash https://api.voidhash.com/api/mcp

{
  "mcpServers": {
    "voidhash": { "url": "https://api.voidhash.com/api/mcp" }
  }
}

codex mcp add voidhash --url https://api.voidhash.com/api/mcp

{
  "servers": {
    "voidhash": { "type": "http", "url": "https://api.voidhash.com/api/mcp" }
  }
}

{
  "mcpServers": {
    "voidhash": { "type": "http", "url": "https://api.voidhash.com/api/mcp" }
  }
}

Sign in

The first time the agent calls the server, your browser opens Voidhash. Sign in if needed, check the agent's name on the Connect page, choose whether it's Read-only, and choose Connect. Approve an agent only if you just started its sign-in.

The agent then appears in Personal settings → Devices and apps, where you can make it read-only or disconnect it. An agent unused for 90 days is signed out. An agent can't change its own read-only setting, disconnect apps or create keys.

Unattended agents

An agent that runs on a server or a schedule, with nobody to sign in, uses a project secret key instead, sent as a bearer token:

Authorization: Bearer vh_sk_...

Give the key only the access the agent needs. Publishable keys are rejected.

Permissions

The agent acts as you: in each project of each team you belong to, it can do what your role allows, and nothing more. With a secret key, it can do what the key's access allows, in the key's project. The server lists only the tools the caller may use, so a read-only agent sees only tools that read. When your role changes or you leave a team, the agent's access changes on its next request. Every change it makes is recorded in the audit log as yours, with the agent named.

Some things always stay with you in Studio or the CLI: store, push and ad account credentials, API keys, connected apps, making someone an admin, and starting a paywall build with a secret key. Tools that create a webhook or payment source, or rotate a secret, return the signing secret once; store it in your backend's secrets, not in a chat or a repository.

Choose a project

Every project tool takes an optional project argument, a project ID or slug, and list_projects lists your projects. You can leave it out when you have one project, when you use a secret key, or when your client sends a default project in the X-Voidhash-Project header. Team tools take an optional organization instead.

Changes that ask first

A change that can't be undone, or that reaches many people at once, doesn't happen on the first call. The tool reports what would change and who it affects, changes nothing, and returns the exact arguments that make the change, including confirm: true. Your agent should show you the report and call again only after you agree. The confirmed call acts on the IDs you were shown. Each tool group page marks the tools that ask first.

Tools that only read carry MCP's read-only annotation, so your client may run them without asking.

Tools

The server groups its 193 tools into toolsets. An agent sees only the tools your role, or a secret key's access, allows; each toolset names the key access it needs. Asks first marks a tool that reports its effect and waits for confirm: true, always or in the case given.

• People and access: people, access explanations, erasure and simulated purchases.
• Catalog and payments: products, perks, store mappings and payment sources.
• Paywalls: paywalls, locations, builds and the paywall design session.
• Flags and experiments: feature flags and A/B tests.
• Analytics and ads: metrics, charts, events, VoidQL, alerts and ads.
• Webhooks and messaging: webhooks, push notifications and automations.
• Projects, team and settings: projects, members, settings, domains and the audit log.
• Files and assets: files, boards, tasks, the inbox and uploaded assets.

Tools take things by name: a product, perk, paywall or location by ID, slug or exact name; a person by email, distinct ID or person ID; a webhook by ID, name or URL; a flag by key. Results start with a summary in words, followed by the same result as structured data. Long lists come a page at a time.

Resources and prompts

The server also offers guides an agent can read as resources, and one prompt:

Verify the connection

Ask the agent:

Which Voidhash projects can you see?

It should call list_projects. Then ask "What was my MRR over the last 30 days in my-app?"; it should call run_insight.

If the agent says it isn't signed in, start its sign-in again: in Claude Code, run /mcp and authenticate the voidhash server; in Codex, run codex mcp login voidhash. If a tool you expect is missing, your role doesn't allow it in that project, or the agent is read-only.

Example prompts

• "Someone says they paid for Pro but have no access. Their email is ada@example.com."
• "Add a yearly plan that grants premium, and map it to com.example.pro.annual."
• "Which store products aren't mapped to a product yet?"
• "Our backend missed purchase events last night. Find out why, and resend them once it's fixed."
• "How did trials convert last month compared with the month before?"
• "Which Meta campaigns paid back last month, and is anything broken?"
• "Which people spent more than $500 but have no active subscription?"
• "Test whether showing the annual plan first at onboarding raises trial starts."

Next steps

• People and access: the tools support questions start with.
• Members and roles: what your role lets an agent do.
• API keys: create a secret key for an unattended agent.