AI agents

Connect your AI agent to a project in the LAY7 cloud. The agent can then view, create and change resources, for example create a database, connect a domain to an application or check the status of your backups. You decide what it may do and see every one of its actions.

The connection uses the Model Context Protocol (MCP). Supported agents include:

• Claude and Claude Code
• ChatGPT
• Cursor
• VS Code
• your own agents, for example built with an agent SDK or running in a CI pipeline

One connection, one project

Each connection belongs to exactly one project and has its own MCP URL. The agent only sees the resources of this project. Other projects, your account, invoices, payment methods and API tokens remain blocked for it.

To reach several projects, create one connection per project. Your AI client then shows each project as a separate connector.

Connect an agent

1. Select the project at the top
2. Open AI agents → Connect agent
3. Choose your agent
4. Follow the instructions for your agent

For Claude, ChatGPT, Claude Code, Cursor and VS Code you sign in to the LAY7 cloud from within the agent. You then choose what the agent may do and confirm with Allow access.

Claude

1. In Claude, add a custom connector at claude.ai/customize/connectors
2. Enter the name shown and the MCP URL
3. Choose automatic registration as OAuth client and add the connector
4. Sign in and choose permissions

In Team and Enterprise organizations, an owner adds the connector in the organization settings. Members then connect it at claude.ai/customize/connectors.

ChatGPT

1. In ChatGPT, add a custom MCP server at chatgpt.com/plugins
2. Enter the name shown and the MCP URL
3. Confirm the notice and create the server as a plugin
4. Sign in and choose permissions

Claude Code

Run the command shown in your project directory, for example:

claude mcp add --transport http lay7-my-shop https://mcp.lay7.cloud/p/12345

Then open /mcp in Claude Code, sign in and choose permissions.

Cursor and VS Code

Add the configuration shown to .cursor/mcp.json or .vscode/mcp.json. In VS Code, then start the server in mcp.json. On first use you sign in and choose permissions.

Custom agent with a token

For agents without sign-in, such as agent SDKs or CI pipelines, create a token:

1. Choose Custom agent
2. Enter a name and choose when the token expires
3. Choose permissions and click Create token
4. Copy the token or the ready-made configuration

The token is shown only once. Keep it as safe as a password. The agent sends it as Authorization: Bearer … to the MCP URL.

Permissions

When connecting, you choose a preset:

With Custom you set the Access per resource, for example for databases, domains or backups: No access, Read or Write. For Sensitive actions you choose Allowed, With approval or Blocked:

• Destructive actions – for example deleting resources, restoring backups, rotating passwords and keys or running commands in a container
• Orders – registering or transferring domains, changing the package. Orders are never possible without your approval, so only With approval or Blocked are available here
• Domain contacts – names and addresses of the domain owners in your account. With Search with approval the agent only finds a contact through a search you approve

You can change the permissions of a connection at any time under AI agents → Connections → connection → Permissions → Edit. They apply from the next execution.

Secrets

Everything the agent reads is sent to the provider of your AI agent. By default, the agent therefore only sees passwords and credentials, for example of databases and caches, as well as container variables and secrets in masked form. Environment variables of an application that you marked as secret are never returned by the LAY7 cloud.

If the agent needs the values anyway, enable Show secrets in plain text under Custom.

Approvals

If an action requires approval, the LAY7 cloud does not run it right away. Instead, the agent receives a short summary and a link to the approval, for example "Delete database shop-prod".

1. Open the link or go to AI agents → Activity. Pending requests are listed at the top under Awaiting your approval
2. Review the request: summary, affected resource, the exact request data and, for orders, the price
3. Click Approve and execute or Reject

You approve exactly this one request. The agent cannot change it afterwards. Pending approvals expire after 15 minutes. For orders, the price you approved applies.

Unless you pay by invoice, an approved order waits for your payment. Click Pay now in the approval. It is only carried out after that.

Follow the activity

Under AI agents → Activity you see every execution of your agents:

• the code the agent ran
• every single request with method, path and status
• the result or the error

Use the filter to narrow the history down to a status or a connection. The activity of a single connection is also shown on its detail page.

Queue

If an execution cannot start right away, for example in a new project, it is queued and starts automatically as soon as possible. The agent fetches the result itself later. As long as an execution is Queued, you can cancel it in the activity.

Each connection can have up to 5 queued executions. An execution that does not start within 30 minutes expires.

Revoke a connection

Open AI agents → Connections, select the connection and click Revoke. The agent immediately loses access to the project, queued executions are discarded.

Connections with an expiry date end automatically. To keep using an agent afterwards, connect it again.

Security

• Every action of the agent is a regular request to the LAY7 cloud API and is checked and logged there.
• The agent's code runs in an isolated environment that can only reach the LAY7 cloud API. No permanent credentials are stored there, each execution gets its own access that expires afterwards.
• Manipulated content, for example in a website or a document, can trick an AI agent into unwanted actions. Therefore grant only the permissions you need and keep approvals for destructive actions.

Limits

• 30 seconds runtime per execution
• 50 requests per execution, 6 of them at the same time
• 60 calls per minute and connection

For developers

The MCP server provides four tools to the agent:

Instead of one tool per endpoint, the agent writes short code against the regular LAY7 cloud API. This way it handles tasks with many steps in a single execution:

const { data: dbs } = await lay7.get('/databases');
const runs = await Promise.all(
    dbs.map((db) => lay7.get(`/databases/${db.id}/backup-runs`))
);
return dbs.map((db, i) => ({
    name: db.name,
    lastBackup: runs[i].data[0]?.finished_at ?? null,
}));

• Available are lay7.get(path, query), lay7.post/put/patch/delete(path, body), sleep(ms) and console.log. Paths are relative, the project is set automatically.
• Failed requests throw Lay7ApiError with status and errors.
• Requests that need approval throw Lay7ApprovalRequired with approval.summary and approval.url.
• The return value comes back as JSON, together with the console output and the list of requests.