MCP Integration

Rollout provides a Model Context Protocol (MCP) server that lets AI assistants like Claude Code work inside your workspace. An assistant connected over MCP can read and manage tasks, projects, objectives, documents, workflows, and more — always acting as you, inside one workspace.

Quick setup for Claude Code

1. Add the MCP server

Add Rollout to your Claude Code MCP configuration — ~/.claude.json for all projects, or .claude/mcp.json inside a project:

{
  "mcpServers": {
    "rollout": {
      "type": "http",
      "url": "https://your-rollout-instance.com/mcp"
    }
  }
}

Replace your-rollout-instance.com with your Rollout URL (or localhost:4000 for local development).

2. Authenticate

Run /mcp in Claude Code and pick the Rollout server to start authentication. Claude Code:

1. Registers itself with Rollout automatically
2. Opens your browser to Rollout's Authorize Application page, which shows the application name, the permissions it requested, and the workspace access will be granted in
3. Waits for you to click Authorize (or Deny)

After you authorize, the browser redirects back to Claude Code and the connection is ready.

Note: access is granted for the workspace you are signed into when you approve. Switch workspaces before authorizing if you need a different one.

3. Start using it

Ask Claude Code in plain language:

List my open tasks
Show the Website Redesign project
Create a task to review the PR

export ROLLOUT_MCP_READ_ONLY=true

The value is read when the application starts, including from a prebuilt release, so changing it requires a restart but not an image rebuild. Accepted true values are true, 1, yes, and on; accepted false values are false, 0, no, and off. Any other value stops startup instead of silently exposing write tools.

Read-only mode removes write tools from MCP discovery and dispatch. OAuth authorization remains an independent boundary: writable deployments still require each write tool's write or admin scope and domain authorization.

Rate limits

Requests over a limit receive 429 Too Many Requests with a Retry-After header. MCP responses include x-ratelimit-limit and x-ratelimit-remaining headers.

Troubleshooting

"Authentication successful, but reconnection failed"

This usually means Claude Code has stale credentials. Try:

1. Remove any hardcoded Authorization headers from your MCP config
2. Restart Claude Code
3. Run /mcp again to re-authenticate

"Invalid or expired token"

Your access token has expired and couldn't be refreshed. Run /mcp to re-authenticate.

"Unauthorized" errors

Make sure:

1. You've authorized the MCP client in your browser
2. Your token has the required scope for the operation (e.g. write for creating tasks)
3. You're an active member of the workspace you authorized

"Session not found"

After a Rollout server restart, clients holding an old session get a 404 and must reinitialize. Most clients do this automatically; if yours doesn't, restart it.

"Too many requests"

You hit a rate limit. Wait the number of seconds in the Retry-After header and try again.

For other MCP clients

Rollout implements standard OAuth 2.1 with these discovery endpoints:

The server supports the authorization_code and refresh_token grant types, PKCE with S256, and public clients (no client secret). Any MCP client that supports OAuth 2.1 with dynamic client registration should work automatically.

Redirect URIs may be HTTPS, a loopback callback (http://127.0.0.1:PORT/…, http://localhost:PORT/…), or a private-use scheme owned by a desktop client (com.raycast-x:/oauth, vscode://…). Schemes that name a code-execution target — javascript, data, file, vbscript — are rejected.