Connect with MCP

Use the exact endpoint#

Connect to https://tabfleet.com/ using Streamable HTTP. There is no /mcp suffix. OAuth-capable clients can sign in and obtain access tokens automatically after you approve the connection.

Add the endpoint in your client, continue with Google, choose your workspace, and approve view-only or browser-control access. Review or revoke access under Connected apps in the dashboard. API keys remain available for clients without OAuth and unattended services.

Connect with OAuth#

Your client discovers authorization from the MCP server’s 401 response. Tabfleet supports authorization code with S256 PKCE, Client ID Metadata Documents, and dynamic client registration for compatible clients.

Access tokens last at most 10 minutes. Refresh tokens rotate and the connection expires after at most 30 days. The provider accepts the previous refresh token for retry compatibility. Store the latest returned refresh token. Reconnect to change permissions.

Tokens are bound to the MCP endpoint. Use API keys for REST and account sign-in for dashboard management. Revoking an app immediately prevents new MCP operations; existing streams are rechecked periodically. Browser sessions keep running until closed or expired.

OAuth metadata · Protected resource metadata · Authentication guide

Codex with an API key (alternative)#

For the CLI, set TABFLEET_API_KEY in the environment used to launch Codex, then add the server:

codex mcp add tabfleet \
  --url https://tabfleet.com/ \
  --bearer-token-env-var TABFLEET_API_KEY

Codex desktop configuration#

Alternatively, add this entry to ~/.codex/config.toml, replacing the placeholder with your dedicated key. Treat that file as a secret and keep it out of repositories. Fully restart Codex after updating it.

Desktop apps may not inherit variables exported in a terminal. A static header avoids that environment mismatch. Use either the static header or bearer_token_env_var, not both for this server. See the official Codex MCP documentation for client settings.

[mcp_servers.tabfleet]
url = "https://tabfleet.com/"
http_headers = { Authorization = "Bearer YOUR_TABFLEET_API_KEY" }

Other compatible clients#

A common configuration shape is shown below. Client schemas vary: select Streamable HTTP, enter the root URL, and configure the Authorization header using your client’s settings or secret storage. This is not a universal configuration file.

{
  "mcpServers": {
    "tabfleet": {
      "url": "https://tabfleet.com/",
      "headers": {
        "Authorization": "Bearer YOUR_TABFLEET_API_KEY"
      }
    }
  }
}

Try a small task#

Ask your connected agent: “Use Tabfleet to open example.com, read the page, and give me a signed view-only browser link. Close the session when I’m finished.”

The agent can launch a browser, navigate, take a text snapshot, and request a standalone viewer. The URL returned by get_live_view requires no sign-in. The liveViewUrl returned by launch_browser is the separate authenticated dashboard link.

Transport behavior#

The endpoint uses stateless Streamable HTTP POST requests with JSON responses. It does not provide resumable SSE or transport session IDs; GET and DELETE return 405. An ordinary unauthenticated visit in a web browser returns 401.

Requests are limited to 64 KiB and 120 per workspace per minute. Send one JSON-RPC message per request. Native clients may omit Origin; browser-origin requests are restricted to Tabfleet’s app and MCP origins.

Tool failures may return HTTP 200 with an MCP result containing isError: true. Inspect that field rather than assuming every HTTP success means the browser action succeeded.

Next: explore the tools#

Preview the tools before connecting#

Read the public tool catalog at https://tabfleet.com/mcp-tools.json for tool names, descriptions, JSON input schemas, and behavior annotations. It contains no account data and does not execute tools. The MCP server card links this catalog in its publisher metadata.

An authenticated tools/list response remains authoritative for the tools available to your connection. Tool calls still require workspace authorization. The list_sessions tool supports cursor pagination for retained session history.

Tabfleet is published in the official MCP Registry under com.tabfleet/tabfleet, with ownership verified through tabfleet.com. Use the MCP Registry link in the site footer to inspect the official record.

You can also find Tabfleet on Smithery. The listing points to this site and connects to the same OAuth-protected Tabfleet MCP endpoint. Authorize your workspace when connecting through Smithery.