At a glance
Only secret keys (
orwel_sk_) work here. The production API key (orwel_...) that lives in your website and the development key (orwel_dev_) are rejected with 401, because both are meant to be public.Step 1: create a key for the agent
Open Settings, API keys, create a key, give it themcp scope and mark it as server only. Name it after the agent that will use it (“Claude Code, laptop”, “Cursor, shared repo”).
With only mcp the agent can use every read tool. To let it write, give the key the matching scope too:
A write tool called without its scope returns a tool error naming the missing scope, so the agent can tell you what to add.
One key per agent pays off later: the keys list shows when each one was last used, and you can revoke one agent without breaking the others.
Step 2: add the server to your client
Replaceorwel_sk_... with the key from step 1.
- Claude Code
- Claude Desktop
- Cursor
- Windsurf
- VS Code
- Other clients
From your project folder:Claude Code asks you to approve the
orwel server the next time it starts. Run claude mcp list to confirm it shows as connected. Add --scope user to make it available in every project instead of only this one.Step 3: check that it works
Ask the agent: “Use the orwel tools to tell me which workspace you are connected to.” It should callget_workspace_context and answer with your workspace name and domain. If it answers from memory instead, the server is not connected; see When something fails.
What to ask
The agent picks the tools by itself. These questions work well because each one maps to data Orwel already has:
Questions about the business (“is this lead a good fit for us?”) work better after the agent reads
get_workspace_context, which includes your business description and ideal customer profiles. Fill those in Settings to get sharper answers.
Tools
Dates use ISO 8601 (
2026-06-01). Every tool except manage_lists, create_lead and send_lead_to_hyperflow only reads data. Those three also need a write scope on the key, see Step 1.
Keeping it safe
- Read only unless you allow writes. Three tools write:
manage_lists,create_leadandsend_lead_to_hyperflow. They only work when the key also haslists:writeorleads:write, so a key with onlymcpcannot change anything. Most clients also ask before each tool call; keep that confirmation on. - Keys stay out of repos. Use the client’s global config, an environment variable or the VS Code input prompt. A key committed by mistake should be revoked, not just deleted from the file.
- Rotate without downtime. Create the new key, update the client, confirm it works, then revoke the old one in Settings, API keys. A revoked key stops working on the next request.
- Shared data. The agent sees the same leads you see, including emails and names. Treat the chat history like any other export of customer data.
When something fails
When a single tool call fails, the error comes back as the tool result with a reason (“No lead or visitor found for that identifier in this workspace”), so the agent can fix the parameters and try again on its own.