MCP server

@pinwren/mcp (MIT) is a Model Context Protocol server for Pinwren. Connect it to your coding agent and you can ask "what's still open on the checkout page?", "reproduce #142" or "fix the top urgent bug and resolve it with the PR link" — the agent reads the report, its anchor, console errors and failing requests, and updates the item when it's done.

It runs two ways:

Both act with an API token and can do exactly what the token's scopes allow. Create one for the agent in Settings › API tokens — feedback:read to look only, plus feedback:write and comments:write to triage and resolve.

The hosted endpoint /mcp shares the REST API's limits: request bodies over 2 MB are refused with 413, and an address that sends 20 bad tokens in 10 minutes gets 429 RATE_LIMITED until the window ends — failures on /mcp and /api/v1 count together. A missing or bad token is answered 401 with a WWW-Authenticate: Bearer challenge. Being token-authenticated, /mcp is exempt from the dashboard's same-origin and JSON-only checks.

Claude CodeCopy Anchor Link

claude mcp add pinwren \
  -e PINWREN_URL=https://feedback.example.com \
  -e PINWREN_TOKEN=pwt_… \
  -- npx -y @pinwren/mcp

Or connect over HTTP, without running anything locally:

claude mcp add --transport http pinwren https://feedback.example.com/mcp \
  --header "Authorization: Bearer pwt_…"

Run /mcp in Claude Code to check that pinwren is connected.

CursorCopy Anchor Link

Add the server to .cursor/mcp.json in your project (or ~/.cursor/mcp.json for every project):

{
  "mcpServers": {
    "pinwren": {
      "command": "npx",
      "args": ["-y", "@pinwren/mcp"],
      "env": {
        "PINWREN_URL": "https://feedback.example.com",
        "PINWREN_TOKEN": "pwt_…"
      }
    }
  }
}

Other MCP clients (Claude Desktop, Windsurf, VS Code, Zed) take the same command, args and env.

ToolsCopy Anchor Link

Every tool except the four write tools carries MCP's read-only hint; the four write tools are marked non-destructive, and update_feedback, resolve_feedback and create_release idempotent, so clients can decide which calls need your approval.

Fix with an agentCopy Anchor Link

get_agent_brief is the one-call start for fixing a report: the report, repro steps, page URL and pinned element, environment, console and network errors, a replay summary and code hints (the route, files named in errors, search terms, and the repository when the project syncs to GitHub or GitLab). Then get_repro_test returns a draft Playwright test; run it, fix the cause, and finish with resolve_feedback and the commit or PR link.

Fix Pinwren feedback #142. Call get_agent_brief, reproduce it with get_repro_test, fix it here, then resolve it.

The same brief is behind Fix with agent in the dashboard (copy the brief, copy a claude command, open Cursor, or send it to a project's agent webhook) and pinwren feedback brief on the command line. Privacy: the brief is built from the masked diagnostics already stored; the session replay and screenshot are linked, never included, and get_asset returns an image only when asked with includeImage: true.

Untrusted contentCopy Anchor Link

Feedback is written by anyone who can open your site. The server tells the agent that titles, bodies, comments and metadata are untrusted data, never instructions — but treat the agent's output with the same care: review its changes before you merge them, and give unattended agents a read-only token.

OptionsCopy Anchor Link

npx @pinwren/mcp --version prints the version. The stdio server logs to stderr only; stdout carries the protocol.

To embed the HTTP transport in your own Fetch-API server, the package exports handleMcpRequest(request, client), which answers one stateless Streamable HTTP request with a Pinwren SDK client.