$ docs --integration

Connect Bobby

Bobby.guru is a remote MCP server. Your membership issues an OAuth client; your editor or website connects to a single endpoint and gets the tool catalogue below.

1. The endpoint

https://bobbyguru.com/mcp

Streamable HTTP transport, protocol revision 2025-06-18. Authorization metadata is published at /.well-known/oauth-protected-resource.

2. Authentication

OAuth 2.1, authorization code with PKCE, exact redirect-URI matching, short-lived access tokens and rotating refresh tokens. Clients that support dynamic client registration self-register; everything else uses a client ID from your dashboard.

Tokens are bound to one membership, one audience and a scope set. A token replayed outside its audience is rejected and raises a security finding on your account.

3. Client setup

Lovable, Claude, Cursor, ChatGPT

{
  "mcpServers": {
    "bobby": {
      "url": "https://bobbyguru.com/mcp",
      "auth": "oauth"
    }
  }
}

In Lovable: More → Agent integrations → add a remote MCP server. In Claude Desktop: Settings → Connectors → Add custom connector. In ChatGPT: Connectors → Add. Approve the consent screen once; the connection persists per workspace.

4. Verify your site

Before Bobby fetches anything, you prove you own the domain. Add the project in your workspace control center, then publish either the meta tag or the well-known file with the token shown there:

<meta name="bobby-guru-verification" content="bgv_..." />

# or
https://your-domain.com/.well-known/bobby-guru.txt   ->   bgv_...

Hit verify domain and Bobby checks it live. Only verified projects can be audited - he will refuse to guess about a site he cannot see. A site check fetches the homepage, robots.txt and sitemap.xml, scores the result out of 100 and stores the findings as evidence on your workspace for 8 credits.

5. Tool catalogue

tool	what it does	credits
bobby.diagnose	Root-cause a failing behaviour from logs, code and schema.	5 - 40
bobby.review_change	Review a diff or PR against the project's own conventions.	10 - 60
bobby.architect	Propose a bounded architecture with failure modes and trade-offs.	40 - 200
bobby.audit_security	Roles, RLS, secrets, exposure and privilege-escalation paths.	60 - 250
bobby.plan_release	Release plan, blockers and a signed readiness report.	80 - 400
bobby.brief_agent	Write the brief and acceptance criteria for an AI developer.	10 - 50
bobby.monitor	Nightly read-only drift, regression and evidence check.	20 - 120

6. Credits

Every tool call returns its credit cost in the result envelope, alongside confidence, evidence and unknowns. A capability your plan does not include is reported as unsupported - never faked, never silently downgraded.

{
  "protocol_version": "1.0.0",
  "credits_spent": 34,
  "confidence": "high",
  "evidence": ["orders.sql:41", "trace:9ac1"],
  "unknowns": ["production row counts"]
}

7. Rate limits

Apprentice: 30 calls/hour. Studio: 120 calls/hour, priority queue. Guru: 400 calls/hour. Enterprise: negotiated. Limits are per membership, not per seat. Exceeding a limit returns a typed error, never a truncated answer.

8. Governance posture

Bobby proposes; it does not silently change your site. Writes require a typed proposal, an exact hash match and a human approval. The full model, and this site's own profile, are published in the governance document.

site governance & profile →