Exposing Your Prompt Library to Claude via MCP: A Working Example

By the end of this walkthrough you'll have an MCP client — Claude Code, Claude Desktop, or claude.ai — that can search, read, and run your PromptHub prompts, chains, skills, and agents, all scoped to your own permissions. Every call still goes through PromptHub's normal role-based access control, so a client can never do more than the account it's connected as is allowed to do. The whole setup is a scoped API key or an OAuth consent screen, not custom server code.

What You Will Build

PromptHub ships a native MCP server over Streamable HTTP at https://promthub.ai/api/mcp/mcp. Point any MCP-compatible client at that single endpoint and it gains 15 tools spanning your Prompts, Prompt Chains, Skills, PlugIns, and Agents. There are two ways to authenticate: a per-user API key (the fastest path for Claude Code, Claude Desktop, and the Claude API's MCP connector) or OAuth 2.1 (the path claude.ai's web custom connectors use, with no key to copy around). This walkthrough covers the API-key path in detail, then explains when to reach for OAuth instead.

Step 1: Create a Scoped API Key

API keys live under Dashboard → Settings → API Keys. Creating one gives you a name field, a set of scopes to grant, and optional settings for expiry and a token spend cap. The plaintext key is shown to you exactly once at creation time — copy it immediately, because PromptHub stores only a hash of it server-side and cannot show it to you again. You can revoke a key at any time from the same page, and a revoked key is rejected by the MCP server immediately, not after some cache expires.

Grant only the scopes your integration actually needs. The full set:

• prompts:read
• prompts:improve
• chains:read
• chains:execute
• skills:read
• plugins:read
• agents:read
• agents:execute

A read-only integration — one that only searches and displays your prompt library — should stick to the *:read scopes and skip anything that spends tokens or executes something.

Step 2: Point Your MCP Client at the Endpoint

Once you have a key, wire it into your MCP client's configuration. Here's a Claude Code / .mcp.json-style entry, with the key pulled from an environment variable rather than hardcoded into the file:

{
  "mcpServers": {
    "prompthub": {
      "type": "http",
      "url": "https://promthub.ai/api/mcp/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_PROMPTHUB_API_KEY_HERE"
      }
    }
  }
}

Replace YOUR_PROMPTHUB_API_KEY_HERE with the real key from Step 1 (or better, an environment-variable reference your MCP client supports) before you save this file anywhere. That placeholder string is a stand-in, not a working credential — never commit a real key into a config file that ends up in version control.

Claude Desktop and other clients that only launch local (stdio) MCP servers need a small bridge to reach a remote HTTP endpoint like this one, since their config format doesn't support an arbitrary URL directly. mcp-remote fills that gap: you point Claude Desktop at a local npx mcp-remote process, and that process forwards the connection to https://promthub.ai/api/mcp/mcp with your bearer token attached.

Step 3: Call the Tools

Once connected, your MCP client has access to all 15 registered tools, grouped by the entity they operate on:

A typical first session looks like: search_prompts to find the right prompt, get_prompt to pull its full text, then either use it directly or hand it to execute_chain if it's part of a larger workflow. execute_chain and execute_agent both run synchronously up to a wait budget and return a "running" status with an execution id to poll if they haven't finished in time — worth knowing before you build a client integration that assumes an instant response.

The OAuth 2.1 Path

Prefer OAuth 2.1 over an API key when you're connecting from claude.ai's web interface rather than a local tool, or when you'd rather not manage a long-lived key at all. PromptHub's OAuth flow uses PKCE with the S256 code-challenge method and issues short-lived access tokens alongside refresh tokens, so a compromised access token has a small blast-radius window rather than standing access indefinitely. In claude.ai, adding PromptHub as a custom connector is as simple as entering the MCP endpoint — claude.ai discovers the authorization server automatically, redirects you to PromptHub to log in and consent, and registers its own OAuth client without any manual configuration on the PromptHub side. No client secret is ever shown to or handled by the connecting client in this flow.

What Happens on Every Call

Every single tool call — whether it arrives via API key or OAuth — passes through the same guard chain before it touches your data:

1. Scope check — does the credential carry the scope this tool requires?
2. Live role re-check — does your current PromptHub role (Admin, Components Editor, Prompt Creator, or Viewer) actually permit this action right now?
3. Rate limit — has this key exceeded its per-minute call budget?
4. Audit log — the call is recorded regardless of outcome.

The order of the first two matters: a key's scopes are set once at creation and act as a ceiling, but your live role is checked on every call. If your role is downgraded after a key was issued, the live role check wins — the key's scopes never override a role restriction added after the fact. A key with agents:execute granted also needs your account to currently hold the canExecuteChains role permission, since the scope alone can't bypass what your role allows. Optionally, a key can carry a token spend cap, so even a key with broad scopes can be capped at a fixed budget separate from your account's overall balance.

Why Tool Results Come Back Marked as Data

Every tool result that echoes back something stored in PromptHub — a prompt's text, a chain's node structure, a Skill's instructions — is explicitly prefixed with a note that the content is user-stored data, not instructions to the assistant. This matters because a prompt or chain body is, from the model's perspective, just more text arriving in the conversation. Without that boundary, a malicious or compromised prompt body could be crafted to look like a new instruction and get followed by the calling model — a prompt-injection risk. Marking tool output as data rather than instructions is the mitigation: the model is told explicitly what it's looking at before it reads it.

---

Ready to try it against your own library? Create a free account, create a scoped API key from Settings, and connect it using the config above. For the complete tool reference, scope table, and every supported client (including the Claude API's MCP connector and claude.ai's custom connectors), see the full MCP server docs, or read how PromptHub's native MCP server fits into a platform or DevEx team's toolchain on the MCP for DevEx page.