How do I give Claude Code or Cursor context about my production environment?

Point the agent at the NOFire AI MCP server over HTTP with a read-only bearer token. The agent then gets nine tools for production context: what a service depends on, what changed on it, its deployment risk score, its blast radius, and its incident history. The token cannot modify anything, so a compromised agent cannot act through it.

How do I safely let Claude Code or Cursor access our production systems?

Give them a read-only view rather than credentials. MCP tokens issued by NOFire AI cannot modify infrastructure, trigger deployments, create or delete resources, or execute commands. The agent sees topology, changes and risk, and nothing it does through the connection reaches production.

Is the NOFire MCP server open source or self-hosted?

Neither. It is hosted at mcp.nofire.ai and authenticates against your NOFire AI workspace, so it reads the production model that workspace has already built. There is nothing to download or run.

Which clients does it work with?

Any MCP client that supports HTTP transport with a custom header. Cursor and Claude Desktop have documented config paths; Claude Code and other clients take the same URL and Authorization header in their own config.

Does the MCP token expire?

Not automatically. It is shown once at creation and cannot be retrieved afterwards, and the recommended practice is to rotate developer keys every six months.

Connect the NOFire MCP server to your coding agent

Before you start

You need three things, and the third is the one people forget.

A NOFire AI workspace with at least one data source connected. The MCP server reads the production model your workspace has already built, so a workspace with nothing connected returns empty results rather than errors, which is confusing on first use. Grafana, Prometheus or Datadog connected, or the Kubernetes agent deployed, is enough.

An MCP client that supports HTTP transport with custom headers. Cursor and Claude Desktop both do, and their config file locations are documented below. Claude Code and other clients accept the same server URL and the same Authorization header in their own configuration.

Permission to create an API token. Token creation sits under Administration in the dashboard, which not every workspace member can reach.

Tool	What the agent can ask
`nofire_search_entities`	Find a service, pod or deployment by name and confirm it exists
`nofire_get_entity_dependencies`	What calls this service, and what it calls
`nofire_get_entity_changes`	What changed on it in the last N hours, with the correlated commits and PRs
`nofire_get_recent_deploys`	The cluster-wide deploy timeline with infra changes alongside
`nofire_assess_deployment_risk`	A 0 to 100 risk score for deploying to this service, with the weighted factors
`nofire_analyze_blast_radius`	How many services fail if this one goes down, by hop depth
`nofire_get_entity_metrics`	The Prometheus metrics available for it, with ready PromQL
`nofire_find_related_incidents`	Past incidents on it, with root cause and recurring patterns
`nofire_get_cluster_summary`	Cluster health, hot entities and recent alert investigations in one call

The steps

1. Create the token. In the NOFire AI dashboard, go to Administration, then API Tokens, then Create API Token. Name it for the person and the tool, something like maria-cursor, and select MCP as the token type. That type is what makes it read-only.

Copy it immediately. The token is shown once and cannot be retrieved later. If it is lost, create a new one and delete the old one.

2. Add the server to your client. The server is https://mcp.nofire.ai/mcp, transport is HTTP, and the token goes in an Authorization header as a bearer token.

For Cursor, edit ~/.cursor/mcp.json on macOS and Linux, or %APPDATA%\.cursor\mcp.json on Windows:

{
  "mcpServers": {
    "NOFireAI": {
      "url": "https://mcp.nofire.ai/mcp",
      "transport": "http",
      "headers": {
        "Authorization": "Bearer your-mcp-api-key-here"
      }
    }
  }
}

For Claude Desktop the JSON is identical. The file is ~/Library/Application Support/Claude/claude_desktop_config.json on macOS, %APPDATA%\Claude\claude_desktop_config.json on Windows, and ~/.config/Claude/claude_desktop_config.json on Linux.

If the file already has other servers under mcpServers, add NOFireAI as a sibling rather than replacing the object.

3. Validate the JSON before saving. A trailing comma or a missing brace does not produce an error. It produces a client that silently loads none of your MCP servers, which looks exactly like a NOFire connection problem and is not one.

4. Fully quit and restart the client. Not reload, not a new window. Both Cursor and Claude Desktop read MCP config at launch, and a reload does not re-read it.

Verify it worked

Ask the agent to list its available tools. The nine nofire_ tools should appear. If they do not, the config was not loaded, and the cause is almost always step 3 or step 4.

Then run one real query. Ask for a service you know exists by name:

Use nofire_search_entities to find the service called checkout.

A working connection returns the entity with its type and namespace. An empty result on a service you know is running means the workspace has no data source covering it, which is a NOFire configuration matter rather than an MCP one.

Then ask the question the connection exists for:

What is the blast radius if checkout goes down?

The agent should call nofire_analyze_blast_radius and come back with dependents by hop depth and the critical ones flagged. That answer is the thing the agent could not have produced from the codebase alone, and it is the test that the integration is doing its job rather than merely connected.

Where it breaks

The token is gone. It displayed once. There is no recovery, only replacement, and the old token should be deleted at the same time.

Reload is not restart. The single most common failure. The config is correct, the client was reloaded, nothing appears. Quit fully.

Malformed JSON drops every server, not just this one. If other MCP servers you had working have also vanished, that is the diagnosis.

Tools return empty results, not errors. The connection is fine and the workspace has no data for what was asked. Check that the relevant source is connected and that the entity name is what NOFire knows it as, since nofire_search_entities exists precisely to confirm names before asking harder questions.

It cannot act, and that is the design. MCP tokens are read-only. An agent connected this way can tell you a deploy is risky and cannot roll it back, cannot restart a pod, cannot change a config. If the goal is an agent that remediates, this connection is the context half of that and not the action half. What governing an agent that acts requires covers the other half, and how to sandbox an agent with write access covers the isolation underneath it.

Rotation is on you. Tokens do not expire. Six months is the recommended interval, and the token name is what makes rotation tractable, which is why step 1 says to name it for the person and the tool.