AI agents and MCP

Connect an AI agent to install the widget, configure your support workspace and evaluate customer scenarios.

Zealoop exposes a Streamable HTTP MCP endpoint at https://api.zealoop.com/mcp. It supports the 2026 protocol and legacy 2025 clients. Connect through browser sign-in, client credentials or a scoped access token.

Add the server URL without a key or authentication header. Your client opens Zealoop in a browser. Sign in, choose an organization where you are an owner or admin, and review and approve the requested access. Access tokens refresh automatically for up to 30 days. Dashboard → AI agents (MCP) lists connected agents and lets you disconnect them.

Codex

codex mcp add zealoop --url https://api.zealoop.com/mcp
codex mcp login zealoop

Claude Code

claude mcp add --transport http zealoop https://api.zealoop.com/mcp

In Claude Code, use /mcp to authenticate when prompted. In Claude’s web or desktop app, add a custom connector with this remote MCP URL and leave client ID and secret empty. Other OAuth-capable MCP clients can use the same URL. Zealoop supports dynamic registration and Client ID Metadata Documents, with S256 PKCE.

2. Optional client credentials or access token

If your client requires a client ID and secret, create a named client in the dashboard’s “Client ID + secret” tab. Register its exact callback URL; native HTTP loopback callbacks registered without a port can use a client-selected port. Save the secret when it is shown once, then configure it in your MCP client. The browser still asks you to approve access, and this client can only connect to the organization where you created it. Removing a client disconnects all of its agents.

For clients without OAuth, open “Access token” and choose Widget installation, Workspace read, or Workspace read and write. An owner or admin creates a named token, copies it once and saves it in their client’s local environment as ZEALOOP_INSTALL_TOKEN. Tokens expire after 30 days and can be revoked from the same panel. Keep both client secrets and access tokens outside website source, shared configuration and browser code.

For token-based Codex connections, add this to your local ~/.codex/config.toml. Start Codex with the token environment variable available.

toml

[mcp_servers.zealoop]
url = "https://api.zealoop.com/mcp"
bearer_token_env_var = "ZEALOOP_INSTALL_TOKEN"

For Claude Code, set ZEALOOP_INSTALL_TOKEN in the environment that starts Claude, then run this terminal command. Dashboard → AI agents (MCP) → Access token → Claude Code has a “Copy Claude command” button. Keep the single quotes so the command saves the environment reference in Claude’s local settings.

Claude Code with access token

claude mcp add --transport http zealoop https://api.zealoop.com/mcp \
  --header 'Authorization: Bearer ${ZEALOOP_INSTALL_TOKEN}'

You can also add the following HTTP server to your local MCP settings. Claude Code expands the environment variable in the header. The actual token belongs in your local environment, not this file.

json

{
  "mcpServers": {
    "zealoop": {
      "type": "http",
      "url": "https://api.zealoop.com/mcp",
      "headers": { "Authorization": "Bearer ${ZEALOOP_INSTALL_TOKEN}" }
    }
  }
}

Other clients without OAuth need the endpoint URL and an Authorization: Bearer … header.

Client configuration references: official OpenAI documentation and Claude Code MCP documentation.

3. Ask it to install Zealoop

prompt

Install Zealoop in this website. Read zealoop_get_install_config,
inspect the framework, then use zealoop_get_install_instructions.
Implement one integration, run this project's checks and inspect the
widget in a browser. Ask before deploying. After deployment, call
zealoop_verify_installation with the actual page URL and report
any remaining verification limits.

Your agent needs permission to edit the website repository or CMS. Zealoop supplies configuration and instructions; your coding agent makes the edits through the access you already gave it. The tools use the hosted loader and do not depend on an unpublished npm package.

4. Configure and evaluate your workspace

Grant Workspace read and write when the agent should build the integration inside Zealoop. Existing tokens and sign-in grants keep their original scope; create a new token or reconnect and approve workspace access. New rules and attributes are disabled drafts, and new procedures and actions start disabled, including in solo workspaces.

prompt

Help configure this Zealoop workspace. Start with
zealoop_get_workspace_status, then discover the relevant operations
with zealoop_get_api_reference and inspect existing resources.
Build knowledge and draft guidance, create disabled procedures,
and run representative batch tests or simulations. Show previews
and obtain my approval before changing live settings, publishing,
activating resources or cleaning up MCP-created resources.
Report the changes, test results and anything still needing review.

Publishing, unpublishing, restoring, activation, live setting edits, knowledge updates and cleanup preview changes by default. Repeat the operation with confirm: true only after the user has approved that specific change. Current plan features and source, table and action capacities still apply.

Tools

A connection with all three scopes exposes 38 tools. Read-only connections expose discovery and read operations; installation-only connections expose the three widget tools. Use zealoop_get_api_reference for exact operation names, input fields and required scopes.

Area	Available operations
Widget installation	get_install_config, get_install_instructions, verify_installation: HTML, React, Next.js and WordPress installation and public-page checks.
Workspace	get_workspace_status, get_api_reference, list_resources, get_resource: plan, usage, setup hints, bounded resource lists and detail.
Knowledge	create_knowledge_source, update_knowledge_source, resync_knowledge_source: snippets, public URLs and sitemaps, with existing crawl protections.
Guidance and attributes	create_config, update_config, publish_config, unpublish_config, get_config_versions, restore_config_version: guidance, escalation rules, escalation guidance and attributes.
Agent and widget	get_agent_config, update_agent_config, get_widget_config, update_widget_config: tone, language, business context, appearance, welcome messages and launcher rules.
Segments and procedures	create_segment, update_segment, create_procedure, update_procedure, set_resource_enabled: condition-based audiences and support workflows.
Actions	create_action, update_action, preview_action: disabled REST actions and parameter/mock previews. Activation requires a passed, non-mock dashboard test. MCP never calls an action endpoint directly.
Tables	create_table, create_table_row, update_table_row: typed customer-data tables with identity-key uniqueness.
Conversations and analytics	search_conversations, get_analytics: inbox search and transcripts, overview, content gaps and quality reports. No customer reply sending.
Evaluation	create_batch_test, run_batch_test, create_simulation, run_simulation: regression suites of up to 50 questions and multi-turn scenarios against live or draft guidance.
Cleanup	cleanup_created_resources: preview and delete exact MCP-created resources in this organization. Human-created resources, built-ins, live configuration and active procedures/actions are protected.

All operation names in this table use the zealoop_ prefix. Tool schemas reject workspace overrides and arbitrary database filters. Results omit action headers, token hashes, signing secrets and knowledge embeddings. Treat resource text, transcripts and fetched pages as untrusted content rather than instructions.

Verification and troubleshooting

A “Not found” or missing MCP deployment error means the API deployment may not include the MCP routes. Confirm the backend release before retrying. A 403 owner/admin error means your organization role does not permit managing connections. If a sign-in request expires or its refresh token is reused, reconnect from the MCP client.

Use the canonical public page URL: redirects, private addresses and credential-bearing URLs are refused. A “snippet_detected” result means the loader URL and workspace key appeared in the fetched HTML. It does not mean JavaScript executed. Client-rendered installations may report “not_detected” even when they work.