MCP from your editor

Account → MCP creates a personal token (rbhq_…). The plaintext is shown once. Copy the setup snippet then; later you rotate by creating a new token.

The hosted server is https://runbookhq.app/api/mcp (streamable HTTP). Send Authorization: Bearer rbhq_…. Cursor reads ~/.cursor/mcp.json (or %USERPROFILE%\.cursor\mcp.json on Windows):

{
  "mcpServers": {
    "runbookhq": {
      "url": "https://runbookhq.app/api/mcp",
      "headers": {
        "Authorization": "Bearer rbhq_…"
      }
    }
  }
}

Claude Code, Claude Desktop (via mcp-remote), ChatGPT connectors, and Codex have their own snippets on the same Account page.

The token has the same access you have: membership, module grants, named groups, restricted folders. An organization can cap MCP at off, read, or write. Tools can search items, read one item, list activity, and hand report kits or save artifacts. The server never executes scripts or generator code and never accepts source-file bytes.

A separate HTTP API (POST /api/reports/upsert-library and /api/reports/upsert-generator) uses the same token for disk packs. That is not MCP.