Connect Epure error tracking to Claude Code, Cursor or Codex with MCP

Your app already sends errors to Epure, and Claude Code is open in the repository. The agent can read every file but not the TypeError your users hit at 14:02. The steps below give it read access to that issue in two commands, without a secret in any config file. Each step has a check, so a failure shows exactly where it happened.

Should I use the hosted Epure MCP server or the stdio package?

Epure serves the same tools over two transports. The hosted server at https://app.epure.sh/mcp speaks Streamable HTTP and signs you in through the client's own OAuth flow, so nothing is installed. The npm package `@epure-sh/mcp` runs locally over stdio, needs Node.js 18 or later, and reads a session you create once with npx -y @epure-sh/mcp login. Pick hosted for Claude Code and Claude on the web. Pick stdio for Cursor, Claude Desktop, Codex and self-hosted instances.

Both transports refuse pasted credentials: the stdio server stops with OAUTH_ONLY when EPURE_TOKEN is set. A self-hosted Epure serves /mcp only when its operator sets EPURE_MCP_ENABLED=true (the default is false), so the stdio package with --url https://errors.example.com is the shorter path there.

How do I add Epure to Claude Code?

Claude Code adds the hosted Epure server with one command, then signs in from inside a session. The --scope user flag makes Epure available in every project on your machine. local, the default, limits it to the current project, and project writes it to a shared .mcp.json (Claude Code MCP docs, checked 6 Nov 2026).

claude mcp add --transport http --scope user epure https://app.epure.sh/mcp
# then, inside a Claude Code session:
/mcp

In /mcp, pick epure and approve the workspace and scopes in the browser. Claude Code keeps the OAuth grant, so no token lands in your shell history. To run the local package instead, for example against a self-hosted instance, sign in first and register the stdio command:

npx -y @epure-sh/mcp login
claude mcp add epure -- npx -y @epure-sh/mcp

# self-hosted: the same --url on both commands
npx -y @epure-sh/mcp login --url https://errors.example.com
claude mcp add epure -- npx -y @epure-sh/mcp --url https://errors.example.com

How do I add Epure to Cursor?

Cursor starts the Epure stdio server from a JSON entry in ~/.cursor/mcp.json (every project) or .cursor/mcp.json (one project). Sign in once in a terminal, then let the package print the entry. The printed configuration holds no credential, so a project file can be committed without sharing access.

npx -y @epure-sh/mcp login
npx -y @epure-sh/mcp init

{
  "mcpServers": {
    "epure": {
      "command": "npx",
      "args": ["-y", "@epure-sh/mcp"]
    }
  }
}

By default, Cursor asks for approval before it runs an MCP tool (Cursor MCP docs, checked 6 Nov 2026). Keep that on while you learn which Epure tools the agent calls. npx -y @epure-sh/mcp init --read-only prints an entry that exposes read tools only.

How do I add Epure to Codex or Claude Desktop?

Codex and Claude Desktop start the same Epure stdio command. Codex registers it with codex mcp add, which writes a [mcp_servers.epure] table to ~/.codex/config.toml (Codex MCP docs, checked 6 Nov 2026). Claude Desktop takes the JSON printed by npx -y @epure-sh/mcp init in its claude_desktop_config.json.

npx -y @epure-sh/mcp login
codex mcp add epure -- npx -y @epure-sh/mcp

[mcp_servers.epure]
command = "npx"
args = ["-y", "@epure-sh/mcp"]

A desktop app must run as the operating-system user who ran login, because the stdio server reads the session from ~/.config/epure/credentials.json (mode 0600). The CLI `@epure-sh/cli` shares that file, so epure auth login signs in both.

How do I sign in to Epure MCP over SSH or on a headless machine?

Epure switches to the OAuth device flow when the machine has no browser. Run the login with --device --no-browser, open the printed URL on your laptop or phone, and confirm the code. The login also picks the device flow by itself when SSH_CLIENT is set or stdin is not a terminal. Tools never open a browser mid-session; an unsigned tool call returns AUTH_REQUIRED at once.

npx -y @epure-sh/mcp login --device --no-browser
# read access only:
npx -y @epure-sh/mcp login --scope read:agent

The default consent asks for read:agent write:triage write:admin, which covers setup work such as alert rules and cron monitors. --scope read:agent grants reading and nothing else. The MCP and CLI reference lists the tools each scope allows.

What is the first Epure tool call to make?

The first useful Epure call is epure_issues_list, which returns a priority-ranked queue of 20 issues by default and up to 100. Then epure_issues_context on one issue ID returns the stack trace, the culprit frame and the breadcrumbs. You don't name tools yourself. Ask in plain words:

List my unresolved Epure issues in production, then explain the top one
and point to the file that throws.

Expect three calls: epure_projects_list for the project ID, epure_issues_list, then epure_issues_context. The context leaves out the raw event payload and end-user data unless the call sets include_payload or include_user. Use a known staging issue for this first run, so a setup problem can't pass for a missing event. No issue yet? Point your Sentry SDK at Epure and send one.

How do I verify the Epure MCP connection works?

The doctor command checks the Epure stdio path end to end: it loads your saved session and calls /api/v1/agent/whoami on the instance. A healthy result returns "ok": true with your instance, identity and "transport": "stdio → REST". Without a session, status and doctor exit with code 4. Our run of @epure-sh/mcp 0.3.0 on 6 Nov 2026, signed out:

$ npx -y @epure-sh/mcp status
{
  "instance": "https://app.epure.sh",
  "authenticated": false,
  "login_command": "epure auth login"
}
$ npx -y @epure-sh/mcp doctor
{"error":{"code":"AUTH_REQUIRED","message":"Sign in with: epure auth login (or epure-mcp login). Use --device on a remote machine."}}

For the hosted server, an unauthenticated request gets 401 and a WWW-Authenticate header pointing at the OAuth metadata. Claude Code reads that header to start sign-in. Same date, trimmed output:

$ curl -si -X POST https://app.epure.sh/mcp \
    -H 'content-type: application/json' \
    -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
HTTP/2 401
www-authenticate: Bearer error="invalid_token", resource_metadata="https://app.epure.sh/.well-known/oauth-protected-resource/mcp", scope="read:agent"

Once signed in, ask the agent for your Epure projects. A list of names proves the session, the scopes and the workspace all line up.

How do I keep Epure MCP read-only?

Epure gives you three read-only controls, and they stack. The OAuth scope read:agent lets a session read issues and change nothing. The --read-only flag removes every write tool from the stdio server, so the agent never sees them. --toolsets issues,projects narrows the list to the resources you name. Workspace roles still apply on the server, whatever the client asks for.

npx -y @epure-sh/mcp login --scope read:agent
npx -y @epure-sh/mcp init --read-only
npx -y @epure-sh/mcp --toolsets issues,projects

Write tools carry readOnlyHint: false, and destructive ones such as epure_projects_delete refuse to run without confirm: true. On the hosted server, a tool that needs a scope you did not grant returns 403 insufficient_scope with the missing scope. Why this matters with production data: what a coding agent should read and write.

How do I revoke Epure MCP access or roll back?

Epure's logout command deletes the local session and revokes the OAuth grant on the server. The CLI's epure auth logout does the same, because both clients share one session. When the server can't be reached, logout still removes the local file and returns a warning telling you to revoke the app in Settings → Connected apps.

npx -y @epure-sh/mcp logout
claude mcp remove epure

For the hosted server, revoke the grant in Settings → Connected apps and run claude mcp remove epure. In Cursor, delete the epure entry from mcp.json; in Codex, delete the [mcp_servers.epure] table. Your issues stay in Epure untouched. Only the agent's access goes away.

Why does Epure MCP fail to connect?

Most Epure MCP failures come from the session, not the network. The stdio server reports each failure as JSON with a stable error.code, so the agent can read it as well as you. Exit code 4 means sign-in is required and 5 means forbidden. The table maps each code to its fix.

Does the Epure MCP server send errors from my app?

The Epure MCP server and CLI read and manage issues; they never send events. Errors still travel from your Sentry SDK to Epure through the DSN, so an app without the DSN change shows an empty queue. Epure tracks errors only, so no traces, replays, profiles or logs reach the agent. How the agent workflow fits the product: let Claude Code or Cursor read your production errors. Plans and the 14-day trial are on Epure pricing.