Connect an assistant
An assistant connects over MCP, to https://cheats.cloud/mcp. There is no local process to install. The client discovers the OAuth endpoints, or you paste a key.
The connection uses the same keys, the same sections, and the same daily limit as the API. A script calls the REST paths under /mcp/.... An assistant speaks MCP at /mcp itself, with no further segment. The two are easy to confuse because they share a prefix.
Before you connect
- Decide which sections the client should reach. A key for Cheats does not need to read Pennies, Dues, or Brain.
- Decide read or read and write. Free is read-only. Writing needs Pro.
- Put any standing rules in Brain first. Briefs and rules are sent when the client connects, before it does anything.
The usual way
- In the client, add the server URL and leave the token field empty.
- The client opens Cheats. Sign in.
- On the consent screen, untick any section that client should not reach. Every section starts ticked.
- Approve. The key it receives is listed under User → API Access → MCP connections. Narrow it or revoke it there without disconnecting and signing in again.
That key is an MCP connection, not one of the API keys. You can keep 10 of each. A dormant script cannot use up the slots your editors need, and the other way around.
Paste a key instead
Some clients only accept a bearer token.
- On User → API Access, create a key. Choose API key or MCP connection, the sections, and read or read and write.
- Copy it then. It is shown once.
- Send
Authorization: Bearer csk_live_...from the client.
Prefer a separate key per client, scoped to what that client does, so you can revoke one without touching the others.
A key nothing has used for 10 days is revoked the next time it is presented, and idle keys are also cleared when you open the list. A connection that has been asleep has to be created again.
What the client can reach
Scopes decide what a key can do. Sections decide what it can touch. Both apply. A request outside the key's sections is refused, and the tool list the client sees is already narrowed to the sections and the scope, so it is not offered buttons that can only fail.
| Plan | Access | Daily limit |
|---|---|---|
| Free | Read only | 20 requests, shared by every key on the account, resetting at midnight UTC |
| Pro | Read and write | 500 requests a day, fair use, plus a short write burst limit |
get_guides returns your Brain briefs and rules. You do not have to call it. The same text was sent at connect. It is there to re-read after a long session or after you edit a rule.
Notes tools and Brain tools cannot see each other's items. An id addressed to the wrong section is not found.
What stays on the site
These change who can see something, email a person, or spend a credential, so they are not tools.
- Who a cheat, a note, a Brain entry, or a card is shared with.
- Project invites and members.
- Ticking items off a list.
- Importing Pennies, a hand-counted balance, and price alerts.
- Renaming, archiving, or deleting a board.
- Adding or switching off an agent, and linking a vendor.
- Editing an hours rate, archiving or deleting an hours project, and the timesheet PDF.
- Editing or freezing a due, marking one unpaid, and sending a reminder.
- Linking GitHub, choosing sensitive paths, and re-running a Diffs analysis.
The MCP clients page lists the tools that do exist, split into read and write.
Client by client
MCP clients has the steps for Claude, Claude Code, Cursor, and the other hosts, plus the marketplace installs. API reference is the REST list for a script of your own.
The VS Code extension and the Chrome extension, linked from the footer, use this same key and this same daily limit.
Related
- Brain for the text the client receives on connect.
- Plans for Free and Pro.
- Start here for what each section is for, which is also what a section tick allows.