bugsink-mcp

A remote MCP server for a self-hosted Bugsink instance, so Claude Code and claude.ai can read your error tracking and triage issues.

One deploy runs on a single Fly.io machine, fronts one Bugsink instance with one API token, and lets connectors in through OAuth 2.1 gated by one shared password. It is read and triage only by design.

Tools

Read:

Triage:

Issues are addressable by UUID or by their short friendly id.

Every event payload is text an attacker chose: any error in a monitored app becomes a string the model reads, so the write surface stays as small as it is.

Related MCP server: Remote MCP Server on Cloudflare

Deploy your own

You need a Bugsink instance reachable over HTTPS, a Bugsink API token (Bugsink UI, Tokens menu), and flyctl.

1. Clone this repo and edit the three values at the top of fly.toml: app, BUGSINK_URL, PUBLIC_HOST. PUBLIC_HOST is normally <app>.fly.dev. Pick a primary_region near your Bugsink instance.

2. Create the app and the volume that keeps OAuth grants alive across deploys:

   fly apps create <app>
   fly volumes create mcp_data --app <app> --region <region> --size 1

3. Set the two secrets:

   cp .env.example .env     # fill in BUGSINK_TOKEN and MCP_PASSWORD
   ./scripts/push-env.sh --stage

   MCP_PASSWORD must be at least 20 characters or the server refuses to start.

4. Deploy:

   fly deploy
   curl https://<PUBLIC_HOST>/health

Connect from Claude Code

claude mcp add --transport http bugsink https://<PUBLIC_HOST>/mcp

Adding the server does not authenticate it. Run /mcp in a session and authenticate from there; the password is MCP_PASSWORD.

To share the connection with everyone working in a repo, add it at project scope instead. That writes a .mcp.json you can commit; committing it shares the URL, not access, so each person still needs the password.

claude mcp add --transport http --scope project bugsink https://<PUBLIC_HOST>/mcp

Connect from claude.ai

Add https://<PUBLIC_HOST>/mcp as a custom connector.

Access model

One deploy has one principal. Every token the server issues belongs to the same owner, whoever typed the password. Giving someone the password gives them everything the tools can do against your Bugsink instance. For separate access, run separate deploys.

• Revoke everyone. Open https://<PUBLIC_HOST>/logout and enter the password. Every issued token dies. Connectors reconnect by logging in again.

• Rotate the password. Change MCP_PASSWORD in .env, run ./scripts/push-env.sh, then visit /logout with the new password. Changing the password alone does not sign out existing connectors.

• Cut off the server. Delete the API token in Bugsink. Every tool call fails immediately.

• Locked out. A 429 on the login or logout page means too many wrong guesses, from you or from anyone else. It clears on its own within 15 minutes.

Run locally

uv venv && source .venv/bin/activate
uv pip install -r requirements.txt

export BUGSINK_URL=https://bugsink.example.com
export BUGSINK_TOKEN=...
export MCP_PASSWORD=$(openssl rand -hex 16)
export PUBLIC_HOST=127.0.0.1
export PUBLIC_BASE=http://127.0.0.1:8000
export OAUTH_DB_PATH=./oauth.db
uvicorn server:app --port 8000

claude mcp add --transport http bugsink-local http://127.0.0.1:8000/mcp

Configuration

How it works

• server.py is the tools and the transport.

• oauth.py is the authorization server and the login page.

Each module's docstring carries the design. Tested against Bugsink 2.5.

Development

uvx ruff check . && uvx ruff format --check .

License

MIT