Connect any MCP app. With an API key and one config entry.
Any app that can add a remote MCP server and send a header can use SuperEbook with an API key: code editors, agents, or a client you build yourself. The technical details are below.
Server URL
https://www.superebook.ai/api/mcpPaste it exactly as it is, with www.
Apps with a guide of their own
These apps have their own steps, config and sign-in. If yours is one of them, its guide is the quicker way:
Set it up
Create an API key.
In SuperEbook, open Settings → Connect apps and choose Create API key. Name it after the app, then copy it: you see the whole key only once. It needs a verified email address, and you can have 5 keys at a time.
Add it to the app’s MCP settings.
Most apps that take remote servers read an entry like this:
{ "mcpServers": { "superebook": { "url": "https://www.superebook.ai/api/mcp", "headers": { "Authorization": "Bearer YOUR_KEY" } } } }Replace
YOUR_KEYwith your key. Some apps name the list or its fields differently, so check where your app keeps its MCP settings and what it expects.Reload the app and try it.
Ask it: “List my SuperEbook books.”
Signing in instead
If your app signs in to MCP servers through the browser, give it the server URL alone. SuperEbook’s page opens and shows where the app will send you back. When that isn’t Claude or this computer, it warns you and asks you to confirm you started connecting there yourself before you can allow it.
For developers
- Transport
- Streamable HTTP at
https://www.superebook.ai/api/mcp. Every request is a POST answered with one JSON response: no SSE stream and no session id. - Versions
- 2025-11-25, 2025-06-18 and 2025-03-26. JSON-RPC batches aren’t accepted.
- Methods
initialize,ping,tools/listandtools/call. The resource and prompt lists are empty.- API keys
Authorization: Bearer <key>. Keys startebk_live_and work until you revoke them.- OAuth
- OAuth 2.1. A request without a token gets a 401 whose
WWW-Authenticateheader points to the protected-resource metadata. Dynamic client registration, PKCE with S256 and the scopebooks. Access tokens last 1 hour and refresh tokens 30 days, rotating on every use. - Browsers
- A request with an Origin header must come from claude.ai, claude.com, SuperEbook itself or localhost; any other gets a 403. Server-side clients send none.
- Refusals
- A refused tool call is a normal result with
isError: true. Its text starts with a code, such asINSUFFICIENT_CREDITS, andstructuredContent.errorcarries the code, the message and any numbers or links that go with it, such asprice,balanceandretryAfterSeconds. - Limits
- The same as every app’s: credits and limits.
Keeping keys safe
- Give each app its own key, so you can revoke one without touching the others.
- Keep keys out of files you share or commit. If the app can read a key from an environment variable, use that.
- Revoke a key in Settings → Connect apps and it stops working at once. SuperEbook keeps only a one-way hash, so a lost key can’t be shown again: make a new one.
If it doesn’t work
- 401 Unauthorized
- The key is missing, mistyped or revoked. Send it whole, as Authorization: Bearer YOUR_KEY.
- 403, “Requests from this origin aren’t allowed.”
- A web page on another site can’t call the server from the browser. Call it from a server-side client, which sends no Origin header.
- 429 Too Many Requests
RATE_LIMITED - Wait as long as it says: Retry-After on a 429, retryAfterSeconds on a refused tool call. A connection can make 60 requests a minute, and an account 600 an hour.
- The app can’t connect at all
- It has to speak Streamable HTTP. An app that only knows the older SSE transport can’t connect: the server answers every request in plain JSON.
- The tools don’t appear
- Reload or restart the app so it reads its MCP settings again.
For credits, limits and the other refusals a tool can give, see if something goes wrong.