Quickstart: MCP

Greatwait is a remote MCP server. It speaks Streamable HTTP at one address, publishes RFC 9728 discovery beside it, registers clients dynamically, and authorizes them with OAuth 2.1 and S256 PKCE. A client that supports all of that needs the address and nothing else.

A connection acts in one project and one environment for its whole life. There is no tool that moves between them, and a tool argument naming another project is refused rather than ignored.

​

Scopes

A connection that reaches first value needs endpoints:read, occurrences:read, schedules:read, schedules:write. A connection authorized for fewer lists fewer tools, which is the quickest way to tell a scope problem from a connection problem.

​

What an MCP client cannot do, and why

It cannot create a destination. Creating one returns a signing secret that is shown exactly once, and MCP has no channel that could carry it without putting it into ordinary tool history. So the destination is created by a person in the dashboard, or through the API, and the client works against it. Every withheld operation, with its reason, is in the MCP tools reference.

This is the sequence a connected client walks:

First value is reading the attempt, not creating the schedule. Creating a schedule proves the server accepted something; reading the occurrence and its delivery attempt is the first point at which you can see that a real call was made to your address and what came back.

Cancelling comes last because it only stops a schedule that has not fired. Once a one-shot has delivered there is nothing left to cancel, and the call answers state_conflict.

​

Cursor

The editor. Its MCP client is its own implementation rather than the reference SDK, which is why it is the second client this product proves against.

Before you start.

• A project. Accept your Greatwait invitation, sign in, and create a project in the dashboard. projects.create accepts only a signed-in member, so a project is created by a person rather than by an API credential.
• An HTTPS receiver you control. Have an HTTPS URL of your own that answers POST with a 2xx status, and can be reached from the public internet. Greatwait delivers your callback to an address you control. It does not offer a shared receiver to try, and it will not send your payload to a third-party inspection service on your behalf.

​

OAuth

Cursor discovers and registers itself from the address alone. The approval lives with Cursor and is disconnected from Greatwait’s connected-applications list.

1. Add the server to Cursor’s MCP configuration. One entry, one address. Cursor reads the discovery document itself and works out that the server needs authorizing.

In ~/.cursor/mcp.json:

{
  "mcpServers": {
    "greatwait": {
      "url": "https://api.greatwait.dev/mcp"
    }
  }
}

2. Authorize it. Cursor registers itself and opens Greatwait’s consent screen in your browser. Approve it there. Inside the editor the same step is the sign-in prompt beside the server in settings.

cursor-agent mcp login greatwait

3. Check what it can do. The tools your connection is allowed to see. A connection authorized for fewer scopes lists fewer tools, which is the quickest way to tell a scope problem from a connection problem.

cursor-agent mcp list-tools greatwait

​

API key

The fallback, for when OAuth cannot be used. It trades a revocable approval for a secret sitting in a file.

This writes a credential to disk. This writes a credential secret into a file on your machine in plain text, where every process running as you can read it and any backup of your home directory keeps a copy. Prefer OAuth. If you use a key here, scope it to what the connection actually needs and rotate it on the same schedule as anything else you keep in a dotfile.

1. Issue a scoped key. On the API keys panel, issue a key with the scopes this setup lists. The secret is shown once.

2. Write the key into the configuration. Replace the placeholder with the secret. Nothing in Greatwait fills this in for you, and no page will show you the value again.

In ~/.cursor/mcp.json:

{
  "mcpServers": {
    "greatwait": {
      "headers": {
        "Authorization": "Bearer <the key, shown once at creation>"
      },
      "url": "https://api.greatwait.dev/mcp"
    }
  }
}

​

When it refuses

​

Turning a connection off

An OAuth connection is disconnected from Connected applications on the access page, and the next tool call it makes is refused. A key is revoked from the API keys panel on the same page, and nothing brings it back — issue a new one and update the client’s configuration.