Cloud MCP

What to ask

• “Which registers are offline right now and since when?”
• “Where does the fiscal drive end soon? Sort by days.”
• “What happened on the foyer register today?”
• “How many receipts did each point print this month?”
• “Make an X-report on register 42” — the assistant calls call_agent, the client asks for confirmation.

Connecting

The address https://cloud.hw-connector.ru/mcp is enough: the client opens sign-in to the hw-connector.ru cabinet (OAuth 2.1), you choose the access — read-only or full access (commands to registers, receipts) — and allow it. To disconnect an application — cabinet → Cloud → Connected applications. Clients without OAuth sign-in — an account API key hwk_… in a header (preferably read-only).

claude.ai and Claude Desktop

Settings → Connectors → Add custom connector → address https://cloud.hw-connector.ru/mcp → Connect: the cabinet sign-in opens. The same in the browser and in Claude Desktop.

The old way for Claude Desktop — the mcp-remote bridge with a key in claude_desktop_config.json:

{
  "mcpServers": {
    "hw-cloud": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://cloud.hw-connector.ru/mcp",
        "--header",
        "Authorization: Bearer hwk_…"
      ]
    }
  }
}

Claude Code

claude mcp add --transport http hw-cloud https://cloud.hw-connector.ru/mcp
# then in Claude Code: /mcp → hw-cloud → Authenticate (sign in to the cabinet)

# or with an API key, no sign-in:
claude mcp add --transport http hw-cloud https://cloud.hw-connector.ru/mcp --header "Authorization: Bearer hwk_…"

Cursor

Address without a key — Cursor offers to sign in; with a key — add "headers": {"Authorization": "Bearer hwk_…"}.

{
  "mcpServers": {
    "hw-cloud": {
      "url": "https://cloud.hw-connector.ru/mcp"
    }
  }
}

VS Code

{
  "servers": {
    "hw-cloud": {
      "type": "http",
      "url": "https://cloud.hw-connector.ru/mcp",
      "headers": {
        "Authorization": "Bearer hwk_…"
      }
    }
  }
}

Other clients and a check

Any MCP client with Streamable HTTP: with OAuth 2.1 sign-in (metadata — https://cloud.hw-connector.ru/.well-known/oauth-authorization-server, dynamic client registration — RFC 7591, PKCE S256) or with a key header (X-Api-Key works too). The server is stateless: POST with JSON-RPC, the response is JSON. A check without a client:

curl https://cloud.hw-connector.ru/mcp -H 'Authorization: Bearer hwk_…' -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_summary","arguments":{}}}'

Tools

Thin wrappers over the Cloud API: the same account checks, errors and log. Reads carry readOnlyHint; call_agent and create_receipt carry destructiveHint: the client asks for confirmation. An error is a result with isError: true and the cloud code (DEVICE_NOT_FOUND, NOT_CONNECTED, DEVICE_DISABLED…).

Prompts

• check_fleet — Check the register fleet: Summary, alerts and what needs attention — no operations on registers

Safety

• Read-only access (sign-in or key) — the assistant sees only reading tools: call_agent, create_receipt and update_device are unavailable (KEY_READ_ONLY). That is enough to watch the fleet.
• Full access covers all account registers. call_agent and create_receipt run real operations: printing, a fiscal receipt, a terminal payment. Do not enable auto-approval of these tools in the client.
• The cloud does not pass device setup (/api/v1/setup). A register can be disabled (update_device / PATCH /api/v1/devices/{id}) — neither the assistant nor integrations can send it anything; on the register itself cloud commands are switched off in the agent settings.
• Every agent request is in the log (list_requests, GET /api/v1/requests). The limit is 600 calls per minute per account. A key is revoked and an application disconnected in the cabinet at once.
• OAuth sign-in: the access token lives an hour, the refresh token 30 days and changes on every refresh; a replayed old token or code disconnects the application. The cloud stores only token hashes.