Prompt: connect an ai agent to ird through the mcp server
Have an agent get the ird MCP server running for your AI tooling — the
ird CLI installed and signed in, the server registered in your coding
agent, editor or desktop client, the choice between your login session
and an API key made deliberately — then prove it with free calls and
tell you which jobs still need the CLI. No credential is ever pasted
into the conversation.
Needs: a shell on the machine that runs the AI client; the ird CLI (installed, or installable as its docs describe); an ird account
Costs: none — the proving calls are reads; credits_prices has no line for the balance read or a single availability check (nearest key: domains.search.per_availability_check), so say "no price-book line" rather than "free"
Group: developer workflow
Paste everything below the line into a fresh conversation. Fill in the
FILL IN block first.
Task
Set up the ird MCP server for CLIENT on this machine, using AUTH, and
verify it end to end. Nothing here spends credits.
FILL IN
CLIENT: coding-agent CLI # coding-agent CLI | cursor | desktop app | several, comma-separated
AUTH: login # login = browser-approved session on this machine; key = an API key in IRD_API_KEY
PURPOSE: manage DNS for example.ro and publish docs.example.ro on IPFS # what the agent will do — decides AUTH and the CLI-only list
Non-negotiable rules
- No credential in chat, ever. Not the login confirmation code, not
an API key, not a config file holding one. Tell me what goes where;
I type it.
- Login is mine.
ird login pairs the terminal through a code I
approve at the URL it prints, then asks for a confirmation code from
that page. I run it in my own terminal; you verify with ird whoami.
- Nothing that spends. Verification is reads only. No
register_domain, ipfs_add, create_tunnel, vps_create,
apps_deploy, p2p_create_app — not even "to test".
- Read the help, don't assume.
ird --help doesn't say how the
CLI is distributed and ird mcp --help documents exactly one client's
registration command; say so rather than inventing paths or flags.
Steps
A. The CLI. ird version; if absent, install it as its docs
describe. ird update --check, and ird update if newer, before
wiring clients to it.
B. Sign in. AUTH = login: I run ird login (code approved at
https://ird.ro/device, confirmation typed back); the session is
stored on this machine and listed under Sessions in my panel. AUTH = key: I create a key — ird keys create <name> needs a
login session, or the panel at https://ird.ro/panel/api-keys — and
export it as IRD_API_KEY in the environment the client starts from
(or ird login --with-key once on a headless machine). Then
ird whoami must name my account. --api-key on any command
overrides both.
C. Register the server. ird mcp is a stdio server using the same
credential as the CLI. It starts before sign-in: domain checks work
right away; the other tools explain how to sign in.
- The coding-agent CLI that
ird mcp --help documents: run the
<agent> mcp add … -- ird mcp line exactly as printed there, with the
user-wide scope so it covers every project; that CLI's mcp add --help
lists an -e KEY=value flag for environment variables — only I type a
key there.
- Cursor and desktop clients: in the client's MCP JSON config (its own
docs say where the file lives) add, under
mcpServers,
"ird": { "command": "ird", "args": ["mcp"] }; with AUTH = key an
"env": { "IRD_API_KEY": "…" } block that I fill in. If a GUI app
can't find ird, put the binary's absolute path in command.
Restart the client afterwards.
D. Prove it. From the client: credits_balance (CLI: ird credits)
returns my balance; check_domain(domain="example.ro") (CLI:
ird domains check example.ro) returns an availability answer. Neither
has its own credits_prices line — report that, not "free". A "sign
in" answer means step B didn't
reach the client's environment (PATH, key not exported). A coding-agent
CLI usually has mcp list / mcp get ird sub-commands to health-check it.
E. AUTH for PURPOSE. Login session: a laptop, one person, revocable
under Sessions. API key: servers, CI, shared machines — account-wide
(keys take a name and nothing else), revoked immediately with
ird keys revoke <key-id>. Some operations refuse keys: ird keys,
and apps_deploy's totp_code (session auth only, per its
description; ird vps create --totp covers the same sensitive-domain
case but its help doesn't say). If PURPOSE includes them, those steps
run under a login.
F. What still needs the CLI. CLI-only: API keys (ird keys),
transfers and trades (ird domains transfer in|out, ird domains
trade), whois and snapshots (ird domains info|dns-snapshot), the web
directory (ird directory), embeddings (ird jobs embed), the tunnel
background helper (ird agent), SSH keys, snapshots and volumes
(ird vps ssh-keys|snapshot|volumes), encryption keys and downloads
(ird ipfs keys|get), tunnel logs (ird tunnels logs|status|stop).
Mark which PURPOSE hits.
Deliverable
CLI version; the account ird whoami names; AUTH chosen and why; the
registration line or JSON block per CLIENT (placeholders for any key);
the two proving results; the CLI-only commands PURPOSE needs; the
credential's revocation path.