Skip to content
ArchFoundry Docs Open the canvas

Connect Claude

Updated October 28, 2026Plans: Free, Pro, Enterprise

Overview

Claude, Claude Code, Cursor or another AI tool can connect to ArchFoundry over MCP, the protocol these tools use to call outside services. Once connected, the agent can see what runs in one connected AWS account and ask for what your app needs, for example a database. It can ask, not build: every request waits until someone on your team reviews and deploys it.

Claude (claude.ai and the desktop app) and Claude Code connect by signing in: you give them the address https://app.archfoundry.ai/mcp, sign in to ArchFoundry, pick the account and click Allow. There is no token to copy. For a tool that cannot sign in, such as Cursor, you create a token instead.

Prerequisites

  • An owner or admin role in your ArchFoundry organization. Only they can connect an agent or create a token.
  • A connected AWS account. An agent works in one account. See Connect your AWS account.
  • Claude, Claude Code, or another AI tool that supports MCP over HTTP.

Steps

To connect by signing in:

  1. In Claude (claude.ai or the desktop app), open Customize, then Connectors. Click Add, then Add custom connector. Name it ArchFoundry, paste https://app.archfoundry.ai/mcp under MCP server URL and click Continue. Then sign in.
  2. Or, in Claude Code, run the command in the example below, then type /mcp, choose archfoundry and sign in.
  3. Your browser opens ArchFoundry. Sign in if you are not already.
  4. The page names the agent and where it goes back to. Under AWS account, choose the account the agent works in.
  5. Click Allow. The browser goes back to your agent, which is now connected.
  6. The first time the agent uses each ArchFoundry tool, Claude asks you to allow it. Allow the four tools listed in the example.

To create a token instead, for an agent that cannot sign in:

  1. In the workspace sidebar, click Coding agents.
  2. Under Or create a token, in Agent name, name the agent so you can tell its token apart later, for example Claude Code on my laptop.
  3. If you have more than one connected account, choose it under Account.
  4. Click Create token.
  5. The token is shown once. Click Copy command for Claude Code, Copy JSON config for Cursor and other clients, or Copy token only.
  6. Run the command, or paste the config into your client's MCP settings.
  7. Click Done. The token is not shown again.

Example

This adds ArchFoundry to Claude Code. It signs in the first time you use it:

bash
claude mcp add --transport http archfoundry https://app.archfoundry.ai/mcp

With a token instead, the copied command adds the token as a header:

bash
claude mcp add --transport http archfoundry https://app.archfoundry.ai/mcp --header "Authorization: Bearer <your-agent-token>"

For Cursor and other MCP clients, the copied config looks like this:

json
{
  "mcpServers": {
    "archfoundry": {
      "url": "https://app.archfoundry.ai/mcp",
      "headers": {
        "Authorization": "Bearer <your-agent-token>"
      }
    }
  }
}

Change <your-agent-token> to the token you copied. It starts with afa_. However it connects, the agent then has four tools:

text
describe_environment     what runs in the account, what ArchFoundry deployed, and what it can deploy, with prices
request_infrastructure   ask for infrastructure in plain words; returns a request id and an approval link
upload_files             for a static site, an address to upload its build output (the folder with index.html)
get_outputs              where a request stands, and once deployed, the endpoints, ports and secret ARNs to use

For a static site, get_outputs asks the agent to upload the site's build output with upload_files. After a person deploys it, ArchFoundry puts those files in the site's bucket, refreshes CloudFront and checks the address answers. Once the address answers, get_outputs says "Live at" and the address.

Ask the agent something like "I need a Postgres database and a container for my API, kept small". It calls request_infrastructure, and the request appears in ArchFoundry for a person to review.

Verify it worked

  • In Coding agents, the agent appears in the list with its account. An agent that signed in says signed in; a token says token and its last four characters. Each says never used until the agent calls ArchFoundry, then last used with a date.
  • A request from the agent appears under Waiting for approval in Deployments. See Approve what a coding agent asks for.

Troubleshooting

Only an owner or admin can connect an agent. Ask one to do it. You are a member of the organization. The page names your owners and admins. Ask one of them to sign in from the agent, or to create a token for it.

This sign-in link has expired or was already used. Start again from your agent. A sign-in link lasts 10 minutes and works once. In Claude, click Connect on the connector again. In Claude Code, type /mcp and sign in again.

This sign-in link was changed and is not safe to use. Start again from your agent. The link was changed after the agent made it. Nothing was connected. Start the sign-in again from the agent.

This sign-in was started in another browser. Start again from your agent. A sign-in link only works in the browser that opened it. Start again from the agent, on this computer.

This sign-in link is not from an agent ArchFoundry knows. Start again from your agent. The agent's registration has expired or the link was changed. Start again from the agent.

This sign-in link is not valid. Start again from your agent. The agent sent a request ArchFoundry cannot accept. Start again from the agent; if it happens again, the agent may not support signing in, so create a token instead.

Too many sign-ins from this address. Wait a few minutes, then start again from your agent. Wait a few minutes and try again.

Agent sign-in is not enabled on this server yet. You reached a server without agent sign-in. Make sure you are on app.archfoundry.ai, or create a token instead.

An agent works in one AWS account. Connect an AWS account (it opens in a new tab), then click Connect again in Claude. No AWS account is connected yet. Connect one, then sign in from the agent again.

Connect an AWS account first. A token is for one account. No AWS account is connected yet. Connect one, then create the token.

Name the agent, so you can tell its token apart later. The Agent name field is empty.

Only an owner or admin of your organization can create or revoke tokens. Ask an owner or admin of your organization to create the token.

Agent access is not enabled on this server yet. You reached a server without agent access switched on. Make sure you are on app.archfoundry.ai.

You lost the token. It is stored as a hash, so nobody can read it back, ArchFoundry included. Click Revoke on it and create a new one.

You want to disconnect an agent. In Coding agents, click Revoke on its row. It stops working at once, whether it signed in or used a token.

The agent never sees a password. That is on purpose. Once a request is deployed, get_outputs gives the ARN of the secret in AWS Secrets Manager that holds it, and your app reads the value from there.

Next steps