@cqnce/mcp-server

Official MCP server for cQnce — add human-in-the-loop authorization to any AI agent or workflow.

Connect Claude, Cursor, GitHub Copilot, or any MCP-compatible client to cQnce so the AI can request human approval before performing risky or irreversible actions.

Quick start

Terminal

npx @cqnce/mcp-server

Set the CQNCE_API_KEY environment variable to your project API key before running.

Approval modes

Mode 1 — Agent-requested approval

The agent calls wait_for_approval or submit_authorization_request itself, as instructed in the system prompt or via tool discovery. This is the easiest integration path and works well for supervised workflows.

Risk: a compromised or misconfigured agent may simply not call the tool.

Mode 2 — Enforced approval gate (recommended for production)

The host application or executor intercepts every sensitive tool call before it runs and requires a prior cQnce approval, regardless of what the agent requested. The gate lives outside the model context — the agent cannot skip it.

This is a real security boundary. Build enterprise and compliance-sensitive integrations on this mode.

python

# Example: host-side interception (framework-agnostic)
HIGH_RISK_TOOLS = {"send_payment", "deploy_production", "delete_customer"}

def execute_tool_call(tool_call):
    if tool_call.name not in HIGH_RISK_TOOLS:
        return run_tool(tool_call)
    decision = cqnce.submit_and_wait(
        payload={"action": tool_call.name, "parameters": tool_call.arguments},
        timeout_seconds=300,
    )
    if decision["status"] != "APPROVED":
        return {"error": "not_authorized", "status": decision["status"]}
    return run_tool(tool_call)

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

config.json

{
  "mcpServers": {
    "cqnce": {
      "command": "npx",
      "args": ["-y", "@cqnce/mcp-server"],
      "env": {
        "CQNCE_API_KEY": "your-project-api-key"
      }
    }
  }
}

Cursor

Add to .cursor/mcp.json in your project (or the global ~/.cursor/mcp.json):

config.json

{
  "mcpServers": {
    "cqnce": {
      "command": "npx",
      "args": ["-y", "@cqnce/mcp-server"],
      "env": {
        "CQNCE_API_KEY": "your-project-api-key"
      }
    }
  }
}

Any MCP client (stdio transport)

bash

CQNCE_API_KEY=your-project-api-key npx @cqnce/mcp-server

Cloud agents (Streamable HTTP / remote MCP)

For cloud-hosted agents that cannot run local processes, use the cQnce MCP Worker deployed on Cloudflare Workers. It speaks the MCP Streamable HTTP transport and is stateless — every request authenticates with your API key.

Configure your cloud agent framework to connect to:

Code

https://mcp.cqnce.app/mcp
Authorization: Bearer <your-project-api-key>

Example (Claude API with MCP):

server.ts

import anthropic

client = anthropic.Anthropic()

response = client.beta.messages.create(
    model="claude-opus-4-5",
    max_tokens=1024,
    mcp_servers=[
        {
            "type": "url",
            "url": "https://mcp.cqnce.app/mcp",
            "name": "cqnce",
            "authorization_token": "your-project-api-key",
        }
    ],
    messages=[{"role": "user", "content": "..."}],
    betas=["mcp-client-2025-04-04"],
)

Self-hosting

The Worker source is in this repository. Deploy your own instance to Cloudflare Workers:

Terminal

npm install
npx wrangler deploy

Set CQNCE_BASE_URL in the Cloudflare dashboard if you use a private cQnce deployment (defaults to https://api.cqnce.app).

Configuration

Variable	Required	Description
`CQNCE_API_KEY`	Yes	Project API key from cqnce.app
`CQNCE_BASE_URL`	No	API base URL (default: `https://api.cqnce.app`)
`CQNCE_ADMIN_TOKEN`	No	Tenant admin JWT — enables project/agent/team management tools

Tools

Core (requires `CQNCE_API_KEY`)

Tool	Description
`wait_for_approval`	Submit a request and block until a human approves or rejects it. This is the primary tool for human-in-the-loop workflows.
`submit_authorization_request`	Submit a request and return the `requestId` immediately (non-blocking).
`poll_request_status`	Check the current status of a request by ID.
`cancel_request`	Cancel a pending request.
`list_requests`	List requests for this project (filterable by status, date, tags).
`get_request`	Get full details of a single request including agent responses.

Admin (requires `CQNCE_ADMIN_TOKEN`)

Project management, routing rule configuration, agent/team management, and webhook callbacks.

Recommended system prompt

When integrating Claude via the Anthropic API, add this system prompt to enforce the authorization policy automatically — without relying on the user to request it each time: