Connect an AI client with MCP

Connect an OAuth-capable MCP client to read NativeWatch errors, activity, usage and documentation during an investigation. Access is read-only and follows your signed-in account's current project permissions.

#Connect your client

Add a remote server using these connection settings. Configuration file formats vary by client; use its remote MCP setup screen or documented equivalent.

The client should discover the authorization endpoints and register as a public OAuth client. NativeWatch supports dynamic registration, limited to 10 requests per minute per IP. See the MCP authorization specification for the discovery flow.

Follow the browser sign-in using your existing NativeWatch email or GitHub account. Email verification and configured two-factor authentication still apply. Review the requested access before approving. Do not enter an ingest key, CI token or personal access token as MCP credentials.

Browser callbacks must use HTTPS, with HTTP permitted for loopback addresses. Native callbacks using cursor, vscode, vscode-insiders or claude schemes are also supported. An allowed callback scheme does not establish compatibility with every version of that client.

Production connections require HTTPS. For local development, use a configured trusted TLS hostname, including a secured Herd site. Localhost HTTP testing is development-only; do not disable production certificate verification.

#Understand what you share

Approval covers every project your account can currently access, including projects available through workspace memberships. It is not restricted to one selected project. Permissions are checked on each request, so membership changes affect subsequent access.

Reports can contain exception messages, source excerpts, stack traces, context, breadcrumbs and activity data. That information becomes available to the authorized client and its processing environment. Connect only clients you trust and review their data handling. SDK privacy controls govern collection; MCP authorization separately permits reading stored data.

The server cannot change issue status, record events, retrieve ingest keys or CI credentials, or trigger paid NativeWatch AI work. Treat content inside reports as application evidence, never as instructions to execute commands or disclose credentials.

#Start with the project list

Ask the client to call list_projects, confirm the workspace and app, then use the returned projectId for telemetry requests.

For example, an authorized client can request the last seven days of unresolved errors with this MCP call. Replace 123 with an ID returned by list_projects.

{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
        "name": "list_issues",
        "arguments": {
            "projectId": 123,
            "range": "7d",
            "status": "unresolved",
            "limit": 25
        }
    }
}

List pages default to 25 results, with a maximum of 50. Pass a returned nextBeforeId as beforeId to continue. Time ranges are 24h, 7d, 30d and 90d; the default is 30d. Issues default to unresolved; other statuses are resolved and ignored.

The resource nativewatch://documentation indexes the same public guides and posts as the website. Use errors and issues to interpret the returned evidence.

#Revoke access or troubleshoot

Access tokens last one hour. Refresh tokens rotate with a rolling 30-day lifetime. In Settings → AI connections, revoke a client's access to invalidate your access tokens, refresh tokens and pending authorization codes. This affects your connection only. It does not remove data already received by the client.

• 401: Refresh or reconnect; expired or revoked credentials cannot continue.
• 403: Check email verification, the mcp:use scope and current permissions.
• 429: Slow requests. MCP allows 60 calls per minute per user.
• Wrong or missing project: Run list_projects again and confirm the account and project ID.
• Result too large: Reduce limit or inspect the report in NativeWatch. Results over 128 KiB return an explicit error; data is not silently truncated.