MagicDoor MCP server
OfficialMagicDoor MCP server
Lets an AI assistant read your MagicDoor portfolio — properties, units, leases, tenants, owners and lease renewals — using an API key you create and can revoke at any time.
It runs on your own machine. Nothing is hosted, and your key never leaves your computer except to MagicDoor itself.
Setup
1. Create an API key in MagicDoor under Settings → API keys. Choose the permissions the
assistant should have — properties:read, units:read, leases:read, tenants:read and
owners:read are enough for everything here. The key is shown once; copy it.
2. Add the server to your assistant's MCP configuration:
{
"mcpServers": {
"magicdoor": {
"command": "npx",
"args": ["-y", "@magicdoor/mcp"],
"env": { "MAGICDOOR_API_KEY": "magic_0_EXAMPLE-NOT-A-REAL-KEY" }
}
}
}For Claude Code, claude mcp add magicdoor -e MAGICDOOR_API_KEY=magic_… -- npx -y @magicdoor/mcp
does the same thing.
3. Restart the assistant. Ask it something like "how many units do we have in the Oak Street property?"
Tools
Portfolio
Tool | Answers questions like |
| What's in the portfolio? How many units does this property have? |
| Who lives where? Who owns what? How do I reach them? |
Leases — several tools take an id for one record, or filters for a list.
Tool | Answers questions like |
| Who's renting what? Which leases carry a balance? One lease in full. |
| What do they owe, what have they paid — charges or deposits. |
| One ledger entry: charge, payment, credit, late fee, transfer or deposit. |
| What's billed or credited each period, rather than what has posted. |
| Autopay, renewal offers, move-outs, subsidies, files or custom fields for a lease. |
| What's ending, who's leaving, what renewed. |
| Has the lease been signed? |
Conversations
Tool | Answers questions like |
| What are people asking about, and what was said? |
| What needs a response? Did anyone mention the boiler? |
Accounting
Tool | Answers questions like |
| What accounts do we hold? How are the books structured? |
| What was this? What moved? What was adjusted by hand? |
| Which payments were banked together? |
| Balance sheet, income statement, cash flow or general ledger. |
| What rent came in? What does this owner get? |
| On-time rent, online payments, daily money movement, returns and disputes. |
Maintenance
Tool | Answers questions like |
| What's broken? What came in this week? One request in full. |
| What work is open? What's happening on Tuesday? |
| What happened with this, and why is it taking so long? |
| What repeats, how often, at what cost? |
| Who do we use for plumbing? How much do we spend with them? |
| How is work classified? What's our process? |
| How much is outstanding? |
Every tool is read-only. There is no way to create, change or delete anything in MagicDoor through this server, by design.
Configuration
Variable | Required | Default | Purpose |
| yes | — | The key you created in MagicDoor. |
| no |
|
|
| no | from | Override the auth host, for local development. |
| no | from | Override the portal API host, for local development. |
| no | from | Override the accounting host, for local development. |
| no | from | Override the maintenance host, for local development. |
How access works
The API key is long-lived; the tokens it produces are not. On the first tool call the server exchanges your key for a 15-minute access token, keeps it in memory, and renews it a minute before it expires. There is no refresh token — the key itself is the durable credential.
Two things follow, and both are deliberate:
Revoking the key stops this server immediately. There is no session to expire.
Narrowing your own MagicDoor permissions narrows the key too. Permissions are re-checked every time a token is issued, so a key can never do more than you can right now.
Releasing
npm version patch # or minor, or major
NPM_TOKEN=npm_xxx ./publish.shnpm will not publish without a second factor. Create a granular access token at
npmjs.com → Access Tokens → Generate New Token → Granular Access Token, with Bypass 2FA
ticked and read/write limited to the @magicdoor scope, and pass it as NPM_TOKEN. It cannot
touch anything outside that scope even if it leaks. If you have 2FA set up instead, pass the
code: ./publish.sh 123456.
publish.sh refuses to run on a dirty tree or a version that is already on npm, checks types,
runs the tests, then publishes.
Development
npm install
npm run build
MAGICDOOR_API_KEY=magic_… MAGICDOOR_ENV=development node dist/index.jsThe server speaks MCP over stdio, so it expects a client on the other end rather than a terminal.
npx @modelcontextprotocol/inspector node dist/index.js gives you one to poke at it with.
This server cannot be installed
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Connect AI agents to bank accounts, transactions, balances, and investments.
Read-only bank access for your AI agent. Connects Claude, ChatGPT, Cursor, Gemini, Codex.
Connect AI assistants to Stellary projects, boards, documents, and governed agent workflows.
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/MagicDoorInc/magicdoor-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server