Connect an LLM client to HFTControl

Choose an access profile

Access is assigned per OAuth connection. A user can keep a Read-only ChatGPT connection and a separate Full-control Claude connection, each bound to its own AWS profile and token family.

1. Open the area used to add a custom remote MCP app or connector.
2. Enter https://control.hftcloud.com/mcp.
3. Select OAuth authentication. HFTControl supports dynamic client registration and PKCE S256.
4. Sign in to HFTControl and confirm the workspace and AWS profile.
5. Leave Read only selected unless this connection actually needs infrastructure control.
6. Choose Full control only when it is available and required. This creates a separate full-control token family.
7. Run the provider tool scan. Start with get_system_health, list_instances, and list_latency_jobs.
8. For Full-control acceptance, create a harmless plan, approve it in HFTControl, apply it, then follow get_operation_status.

Provider menu names vary by product edition. HFTControl does not need an OpenAI API key and does not embed a ChatGPT conversation UI.

1. Add a custom remote MCP connector in Claude or configure the same endpoint in Claude Code.
2. Use https://control.hftcloud.com/mcp and complete HFTControl OAuth.
3. Select Read only or, when permitted, Full control.
4. Verify that Read only lists 25 tools and Full control lists 55 tools.
5. Read synchronized state first. For control, create a plan and approve it in HFTControl before apply.
6. After apply, use get_operation_status or bounded wait_operation.

MCP resource

https://control.hftcloud.com/mcp

OAuth issuer

https://control.hftcloud.com

Transport

Streamable HTTP

Default profile

Read only

PKCE

S256 required

Token refresh

Rotating refresh token

Discovery endpoints:

https://control.hftcloud.com/.well-known/oauth-authorization-server
https://control.hftcloud.com/.well-known/oauth-protected-resource/mcp

Read-only canary:

python3 scripts/mcp_acceptance.py \
  --endpoint https://control.hftcloud.com/mcp \
  --access-token "$HFTCLOUD_MCP_ACCESS_TOKEN" \
  --access-profile read_only

Full-control canary:

python3 scripts/mcp_acceptance.py \
  --endpoint https://control.hftcloud.com/mcp \
  --access-token "$HFTCLOUD_MCP_ACCESS_TOKEN" \
  --access-profile full_control

Full-control workflow

1. The client calls a plan_* tool with a unique idempotency_key.
2. HFTControl snapshots synchronized resources and returns an immutable payload hash, approval URL, action UUID, and context-bound action token.
3. The signed-in user approves or denies the exact payload in User settings → LLM / MCP.
4. The client calls apply_planned_action. HFTControl dispatches the approved action through the existing control plane.
5. Applied means accepted or queued. Follow it with get_operation_status or wait_operation. Completed is downstream terminal success; observed=true means synchronized inventory confirmed the target where a predicate exists.

A Read-only token cannot call these tools. Direct crafted calls are rejected with insufficient_scope.

Tool catalog by profile

Security Group changes are intentionally not exposed through MCP. Use the HFTControl web UI for Security Group administration.

Upgrade, downgrade, and revoke

• Upgrade: start a new OAuth authorization and choose Full control. Existing Read-only tokens are not elevated in place.
• Downgrade: revoke the Full-control token family and reconnect as Read only. Pending and approved control plans from that family are revoked.
• Permission removal: HFTControl invalidates Full-control families that exceed the current workspace/user ceiling.
• Revoke: invalidates the complete access/refresh token family.