Featurebase MCP

A remote MCP server that exposes the full Featurebase REST API as MCP tools, deployable to Cloudflare Workers in minutes.

~96 tools auto-generated from Featurebase's OpenAPI spec — posts, comments, changelogs, contacts, companies, conversations, tickets, help center, and more.

Why?

We're Lunch Flow, a fintech building Open Banking infrastructure for developers. Like a lot of small teams, we rely heavily on Featurebase: it's where our users report bugs, request features, and get support. Rather than context-switching to check on tickets or write changelogs, we wanted Claude to handle it. We figured the pattern — a stateless Cloudflare Worker with real OAuth and per-user access control — was worth sharing since there's no off-the-shelf solution for this yet.

Features

• Zero hand-coded endpoints — tools are generated directly from Featurebase's published OpenAPI spec
• Stateless — runs on Cloudflare Workers with no Durable Objects or databases
• OAuth 2.1 — proper Authorization Code + PKCE flow; works natively with Claude.ai custom connectors
• Per-user access control — each user gets their own Featurebase API key and tool allowlist
• One command deploy — pnpm run publish:secrets

Prerequisites

• Cloudflare account (free tier works)
• Wrangler CLI authenticated (wrangler login)
• A Featurebase API key (sk_...) from your Featurebase API settings

Setup

1. Clone and install

git clone https://github.com/lunchflow/featurebase-mcp
cd featurebase-mcp
pnpm install

2. Generate the tool definitions

Downloads the Featurebase OpenAPI spec and saves it as src/spec.json:

pnpm run generate

Re-run this whenever Featurebase updates their API.

3. Configure users

cp secret.example.json secret.json

Edit secret.json:

{
  "your-client-id": {
    "clientSecret": "run: openssl rand -hex 32",
    "featurebaseApiKey": "sk_...",
    "allowedTools": ["*"]
  },
  "another-user": {
    "clientSecret": "run: openssl rand -hex 32",
    "featurebaseApiKey": "sk_...",
    "allowedTools": ["listPosts", "getPost", "listBoards"]
  }
}

• clientSecret — a random secret for this user (generate with openssl rand -hex 32)
• featurebaseApiKey — their Featurebase sk_... API key
• allowedTools — array of tool names, or ["*"] for full access

4. Deploy

openssl rand -hex 32 | pnpm wrangler secret put OAUTH_SECRET
pnpm run publish:secrets

publish:secrets uploads secret.json as the USERS_CONFIG secret and deploys in one step.

Your server will be live at:

https://featurebase-mcp.<your-account>.workers.dev/mcp

Connecting to Claude.ai

1. Go to Claude.ai → Settings → Custom Connectors → Add
2. Enter your worker URL: https://featurebase-mcp.<your-account>.workers.dev/mcp
3. Set Client ID and Client Secret to the values from secret.json
4. Click Connect — a browser window opens for a one-time login
5. Enter your clientSecret and authorize

Each user repeats this with their own client ID and secret.

Tool allowlist

Use allowedTools in secret.json to control what each user can do. Tool names match Featurebase's operationId values:

Resource	Read	Write	Destructive
Boards	listBoards getBoard	—	—
Posts	listPosts getPost	createPost updatePost	deletePost
Comments	listComments getComment	createComment updateComment	deleteComment
Changelogs	listChangelogs getChangelog	createChangelog updateChangelog	deleteChangelog publishChangelog unpublishChangelog
Contacts	listContacts getContactById getContactByUserId	upsertContact	deleteContactById blockContactById
Companies	listCompanies getCompanyById listCompanyContacts	upsertCompany attachContactToCompany	deleteCompanyById removeContactFromCompany
Conversations	listConversations getConversationById	createConversation replyToConversation updateConversation	deleteConversation redactConversationPart
Tickets	listTickets getTicket	createTicket updateTicket replyToTicket	deleteTicket
Help Center	listArticles getArticle listCollections getCollection	createArticle updateArticle createCollection updateCollection	deleteArticle deleteCollection
Surveys	listSurveys getSurvey getSurveyResponses	—	—
Webhooks	listWebhooks getWebhookById	createWebhook updateWebhook	deleteWebhook refreshWebhookSecret
Admins	listAdmins getAdmin listAdminRoles	—	—

Updating after changes

# Update user access or API keys
# (edit secret.json, then:)
pnpm run publish:secrets

# Refresh the Featurebase API spec
pnpm run generate && pnpm run publish:secrets

Local development

cp secret.example.json .dev.vars  # won't work as-is — see below

Create .dev.vars:

USERS_CONFIG={"your-client-id":{"clientSecret":"test","featurebaseApiKey":"sk_...","allowedTools":["*"]}}
OAUTH_SECRET=any-local-secret

Then:

pnpm run dev
# Server at http://localhost:8787/mcp

Security

• API keys and user secrets are stored as Cloudflare Worker secrets — never in code or the repository
• secret.json is gitignored
• Auth codes are short-lived (60s), HMAC-signed, and verified with PKCE — no token storage required
• Each user's Featurebase API key is scoped to their requests only

License

MIT