Patchrooms

The endpoint speaks JSON-RPC 2.0. Sendmethod,params, and anidin the request body; the response echoes theid.

Two ways in, and the project is resolved from the credential either way — there is no project id in the URL.

API key (headless).An unattended run sends a secret key (prefixpr_sk_) created in the dashboard, as a Bearer token:

Authorization: Bearer pr_sk_xxxxxxxxxxxxxxxxxxxxxxxxxxxx

Either way the grant must carry thefeedback:readscope forlist_reports/get_report, or the endpoint returns403.set_statusadditionally requiresfeedback:write.

Skip this if your client can open a browser — OAuth covers it. For CI and other unattended runs, open the project →Integrations → API keys → Createin the dashboard, and pick the scopes the agent needs:

- feedback:read—list_reports,get_report,list_projects,list_channels.
- feedback:write— additionally allowscreate_report,create_room,set_status,add_comment.
- channel:read/channel:write— read or manage channels (REST API).
- project:read/project:write— read or configure the project (REST API).
- apikey:write— mint and revoke keys (REST API).
- *— wildcard, satisfies any scope. Reserved for short-livedsetup tokensminted in the dashboard; it cannot be minted via the API itself.

Nothing to paste, no key to manage: point the client at the URL and authorize in the browser. The endpoint advertises its OAuth metadata, so the client discovers the rest on its own.

Claude Code— register the server (project scope writes.mcp.json):

claude mcp add --transport http patchrooms https://room.patchrooms.com/mcp --scope project

The resulting.mcp.jsonholds nothing secret, so it is safe to commit:

{ "mcpServers": { "patchrooms": { "type": "http", "url": "https://room.patchrooms.com/mcp" } } }

Cursor, Windsurf, claude.ai connectors and other MCP clients take the same URL with no header.

An unattended run (CI, a cron job, a container with no browser) can’t complete a consent screen. Those authenticate with apr_sk_…key as a Bearer header, read from the environment — never hard-coded, never committed:

claude mcp add --transport http patchrooms https://room.patchrooms.com/mcp \ --header "Authorization: Bearer $PATCHROOMS_API_KEY" --scope project

{ "mcpServers": { "patchrooms": { "type": "http", "url": "https://room.patchrooms.com/mcp", "headers": { "Authorization": "Bearer ${PATCHROOMS_API_KEY}" } } } }

${PATCHROOMS_API_KEY}is expanded from the shell that launched the client, so export it before starting a session.

No MCP client?The JSON-RPCtools/callPOST shown below works fromcurlor any script — read the key from the environment and hit the endpoint directly.

Same OAuth flow, added from the UI instead of a CLI:

Settings → Connectors → Add custom connector→https://room.patchrooms.com/mcp

Claude discovers the OAuth endpoints automatically and opens the Patchrooms consent page. Custom connectors on claude.ai cannot send a custom header at all, so this is the only way in there — and it needs no API key.

Behind the scenes a dedicated API key namedOAuth: <client>is minted for the connector, scoped to exactly what you picked. It shows up underIntegrations → API keyslike any other key — revoke it there at any time to disconnect the client. Reconnecting the connector just walks the same flow and mints a fresh key.

Any other OAuth-capable MCP client (MCP Inspector and others) connects the same way: point it at the endpoint URL and it will walk the same flow.

The server advertises nine tools viatools/list.

Introduces the calling agent — call this once, before the other tools. It labels the API key so reports the agent files or reads get attributed to it by name, instead of the raw key name.

Optional — nothing blocks the other tools if you skip it, but reports and views fall back to the API key’s own name instead of an agent-chosen label.

Returns a single report rendered as Markdown, with its screenshots inlined as image content the agent can look at directly — up to 6 images, capped at 8 MB in total, no separate download step. Marks the reportviewedby the calling agent, same aslist_reports.

Lists the projects this API key can act on — call it before passingprojecttocreate_report,create_room, orlist_channels. A project-scoped key always returns just its own project; an org-wide key returns every project in its organization.

No arguments. Returns a compact JSON array of{ id, name, projectKey, slug, defaultChannelKey }.

Lists a project’s channels — call it before passingchannelKeytocreate_report.

Returns a compact JSON array of{ key, name }.

Files a new feedback report — for agents that spot issues themselves (a failed check, a broken widget, an API defect). The report is marked as submitted via MCP (context.extra.via = 'mcp'). Requires thefeedback:writescope.

Starts (or resumes) a room for an artifact/task you’re working on — idempotent upsert byartifact_id, safe to call every time you begin work, before any report exists. The result includes aurlpointing at the room in the dashboard, ready to hand to a human. Requires thefeedback:writescope.

Triages a report by setting its status. Requires thefeedback:writescope.

Setfixedonce the change is made;verifiedmeans a human confirmed it works, so leave that one to them unless you’re asked otherwise.

Replies in a report’s comment thread — progress updates, questions, or an explanation of a fix on a report the agent is already working. Requires thefeedback:writescope.

Comments land as drafts by default.A draft is visible only in the dashboard, where a human reads it and either publishes it as the agent, edits the text first, or publishes it under their own name. Nothing reaches the thread until they do. Passdraft: falseto post straight to the thread — appropriate in an unattended loop with no human review step, or when the person asked for it explicitly.

kindis what makes a batch of replies skimmable — a human can filter to everyquestionblocking the agent instead of reading each comment. Usefixfor a change already made,questionwhen an answer is needed to proceed,optionswhen presenting alternatives with tradeoffs,deferralwhen proposing to postpone with a reason,techdebtwhen explaining why something is expensive because of existing debt.

curl -s https://room.patchrooms.com/mcp \ -H "Authorization: Bearer pr_sk_xxxxxxxxxxxxxxxxxxxxxxxxxxxx" \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "list_reports", "arguments": { "limit": 2 } } }'

The result is a tool-call envelope whose text content is a JSON array of reports: