Add one MCP server. Build the entire application.
Connect Hedy to Claude, ChatGPT, Cursor, or Claude Code once. From that single connection your AI assistant can configure the project, write the scope, generate the task board, author the application, test it, publish it to a live URL, and keep operating it afterward.
mcp.hedyassist.com/mcp with OAuth or a connector token.
Two ways to add Hedy to your AI assistant.
The Hedy MCP server is a remote endpoint, so there is nothing to install and nothing to run locally. Sign in to Hedy and the workspace gives you the exact setup steps for your assistant.
OAuth sign-in
Best for Claude custom connectors and ChatGPT custom apps. You approve Hedy in the browser and no credential is ever pasted into a prompt.
Claude: add a custom connector pointing at the Hedy MCP URL and complete Hedy sign-in.
ChatGPT: enable Developer mode, create an app with the Hedy MCP URL, choose OAuth, and finish Hedy sign-in.
Scoped access: the connection only ever reaches the companies and projects your Hedy account already has.
Connector token
Best for Cursor, Claude Code, and your own automation. Issue a token from the Hedy workspace and add it as a bearer header:
{
"mcpServers": {
"hedy": {
"url": "https://mcp.hedyassist.com/mcp",
"headers": {
"Authorization": "Bearer ct_company.ut_user"
}
}
}
}Treat connector tokens like credentials: keep them out of prompts, generated code, logs, hosted-app output, and public repositories. Refresh the connector after a Hedy release so your client picks up new tools, and start a fresh chat if it cached the old tool list.
From an empty project to a live application, without leaving the chat.
This is the whole path. Every step below is a real tool call your assistant makes over the same MCP connection, so nothing is re-explained and nothing is copied between systems.
Add the Hedy MCP server
Point your assistant at https://mcp.hedyassist.com/mcp and authorize with OAuth or a connector token. Hedy answers with its tools, project resources, and guided prompts.
Create the project in the right workspace
Your assistant lists the companies you can write to and creates the project there — your personal workspace or a team company. Members and project grants come from the same call path.
Write the scope of work
Requirements land as real scope documents on the project instead of living in a chat transcript. Later work is checked against them, so scope creep is visible rather than assumed.
Generate the task board
Hedy is the backlog for the build. Your assistant creates pages and work items with priority, board status, due dates, and tags, then keeps them current as it implements each one.
Claim a workspace address and enable the app
Claim a workspace slug once, then enable hosting on the project. The app starts in draft: fully testable, not yet public.
Author the application
App files for the front end, server-side JavaScript functions for the API, shared modules for reused logic, and behavior routes for redirects and auth gates. Requests resolve file first, then directory index, then behavior route.
Add data, accounts, and secrets
Project-isolated storage for application data, customer sign-in with a themed login page, managed end-user accounts, write-only secrets, and an explicit allow-list of external HTTPS hosts the app may call.
Test it before anyone sees it
Your assistant invokes real requests against the draft app and reads back the response and logs — including requests made as a specific signed-in app user to verify protected routes.
Go live
Promote the app and it serves immediately at project--workspace.apps.hedyassist.com. Larger builds publish as immutable revisions with checksummed files and deployment logs.
Attach your own domain
Bring a subdomain or a bare apex domain. Hedy returns the DNS records to create and provisions the certificate and routing, then reports status until the domain is active.
Watch it run
Execution logs, errors, product analytics, push subscriptions, and realtime connections are all readable over the same connection. Your assistant diagnoses a failure and fixes it in the same conversation.
Keep iterating safely
Add scheduled jobs, notifications, and realtime channels as the product grows. Every deployment is a revision, so rolling back a bad change is a single call.
40+ grouped tools, plus project resources and guided prompts.
Hedy exposes a deliberately compact, grouped tool surface rather than hundreds of narrow endpoints, so your assistant keeps context available for the actual work. Each tool takes an operation and enforces the right role and scope per call.
Configure & Plan
Projects, companies, pages, scope documents, work items, discussions, activity history, recordings, and assets.
- hedy_project
- hedy_company
- hedy_page
- hedy_scope
- hedy_item
- hedy_apply_action
- hedy_discussion
- hedy_activity
- hedy_recording
- hedy_project_asset
- hedy_invite
- hedy_search_project
- hedy_project_ai_policy
Build
Hosting lifecycle, app files, server functions and shared modules, behavior routes, customer auth, data, secrets, integrations, and manifest sync.
- hedy_app_docs
- hedy_app_workspace
- hedy_app_lifecycle
- hedy_app_file
- hedy_app_functions
- hedy_app_modules
- hedy_app_routes
- hedy_app_configure_auth
- hedy_app_users
- hedy_app_data
- hedy_app_secrets
- hedy_company_secrets
- hedy_app_outbound
- hedy_app_services
- hedy_app_sync
- hedy_app_handoff
Ship & Operate
Synthetic test requests, revisions and rollback, custom domains, execution logs, product analytics, push, realtime, and schedules.
- hedy_app_test_request
- hedy_app_deployments
- hedy_app_domains
- hedy_app_logs
- hedy_app_track
- hedy_app_push
- hedy_app_realtime
- hedy_app_schedules
What the code your assistant writes is allowed to do.
Server-side functions run in a fresh, resource-capped V8 isolate for every request with no ambient network or filesystem access. Everything a function can reach arrives through a project-scoped host bridge.
Project-isolated data
Read, write, list, and increment structured application data. Storage is hard-scoped to the company and project, so one app can never reach another project's records.
Server-side AI calls
Call AI models from inside a function to summarize, classify, or power an in-app assistant. Usage is metered against the project's AI policy and quotas.
Customer accounts
Managed end-user sign-in with a themed login page, remember-me sessions, and protected routes. App consumers are a separate population from your Hedy team.
Write-only secrets
Store credentials at the project or workspace level. Values can never be read back out, and a function only sees the secrets its manifest declares.
Declared outbound HTTPS
Call external APIs, but only the exact hosts the app declares and policy permits. There is no open egress from the sandbox.
Email and Web Push
Send transactional email and Web Push notifications to signed-in app users or to your Hedy team, with bounded recipient lists and delivery caps.
Realtime channels
Publish low-latency WebSocket updates for live dashboards, presence, progress, and cache invalidation on scoped, ticketed channels.
Scheduled execution
Run a function headlessly on a cron cadence, a fixed interval, or a one-shot time, with run history and multi-step continuation for long jobs.
Product analytics
Record explicit events from your own code and read them back as raw events, monthly totals, or a daily series.
Connect the services your business already runs on.
Integrations arrive as reviewed recipes rather than open-ended access. Enabling one stores your credentials, wires the client module, starter functions, and routes into the app, and can run a read-only check to confirm the connection works.
Stripe: API client, hosted Checkout helper, and a verified webhook receiver.
HubSpot: bounded CRM access plus signed inbound webhooks.
Front: read access and signed inbound webhooks, with customer-visible message sending structurally blocked.
Your own recipes: define a private catalog entry for a workspace-specific service using the same primitives and no extra privileges.
Anything else over declared HTTPS
When there is no catalog recipe, your assistant can still call an external API directly — but the app has to declare the exact host first, and the project's policy has to permit it.
Exact hosts only, never wildcards or open egress.
Credentials come from write-only secrets, never from source.
Inbound webhooks are verified and dispatched asynchronously with idempotency.
An AI assistant with real write access needs real boundaries.
Giving an assistant the ability to build and publish software is only safe if the platform constrains it. Hedy is built around controlled execution and an audit trail, not unrestricted access.
An MCP connection can only reach the companies and projects the signed-in Hedy user already has, at the role that user holds.
Server functions run in per-request sandboxes with enforced memory, CPU, and wall-clock limits, and no ambient network or filesystem access.
Application data is prefixed per company and project at the storage layer. Cross-project reads are not reachable from app code.
Secret values cannot be read back through any tool, and functions only receive the secrets they explicitly declare.
Project administrators set which AI models are allowed, request size limits, and daily usage allowances.
Every mutation records the authenticated human behind it, and every deployment is a revision you can roll back.
Questions about the Hedy MCP server
What is the Hedy MCP server?
The Hedy MCP server is a remote Model Context Protocol endpoint at https://mcp.hedyassist.com/mcp. Once your AI assistant is connected, it can read and write real project context and drive the whole application lifecycle: creating the project, writing the scope, generating the task board, authoring app files and server functions, testing requests, publishing to a live URL, attaching a custom domain, and reading runtime logs and analytics.
Which AI clients can connect to Hedy over MCP?
Claude custom connectors and ChatGPT custom apps connect with OAuth. Cursor, Claude Code, and local automation connect with a Hedy connector bearer token in ct_<company>.ut_<user> form. Any MCP-capable client that supports a remote server URL with either OAuth or a bearer header can connect.
Can Hedy build and host the entire application, not just plan it?
Yes. Hedy hosts the application it helps you build. Your assistant uploads app files, writes server-side JavaScript functions and shared modules, defines behavior routes, configures end-user sign-in, stores project-isolated data and secrets, then publishes the app to a live address at project--workspace.apps.hedyassist.com or your own custom domain.
Do I need to write code to build an application with Hedy?
No. You describe what you need in your AI assistant and it calls the Hedy tools to configure the project and build the application. The generated source stays inspectable: you can export the app source manifest, review every file and function, and roll back to any earlier revision at any time.
What can server-side functions in a Hedy app actually do?
Functions run in a per-request V8 isolate with a project-scoped host bridge. They can read and write project-isolated data, call AI models, send email, send Web Push notifications, publish realtime WebSocket updates, record product analytics, read declared secrets, call approved external HTTPS hosts, and continue long jobs on a schedule. There is no ambient network or filesystem access.
Is the Hedy MCP connection free?
Yes. Hedy is free during early access, including the MCP connection, workspace access, and hosted application publishing.
Add Hedy as an MCP server and build the whole thing.
Sign in to get your MCP connection details and the setup steps for Claude, ChatGPT, Cursor, or Claude Code.