Claude and MCP

Connect Claude Code, Cursor or VS Code to Doska over MCP so an AI agent can read boards, draw diagrams, write documents and answer comments.

Doska has a built-in Model Context Protocol server. Connect Claude Code (or another MCP client such as Cursor or VS Code) and the agent can read your boards and documents, draw and update diagrams, add sticky notes and reply to comments. It acts on your behalf, with the rights of the token you give it.

The server address is https://getdoska.top/api/mcp (Streamable HTTP transport). There is nothing to install on the Doska side.

#Quick start

1. In Doska, open the menu under your name at the bottom of the sidebar and choose Settings and API tokens.

2. In Access tokens, click Create token. Choose the access level, projects and expiration (see below), then click Create token.

3. Copy the command shown under Connect to Claude Code and run it in a terminal:

   bashCopy

   claude mcp add --transport http doska https://getdoska.top/api/mcp --header "Authorization: Bearer dsk_…"

   Add --scope user to make the server available in every folder; without it, it works only in the current project.

4. Start claude and check the connection with /mcp.

The token is shown only once. Copy it before you close the panel.

#Other MCP clients

Any client that can send an HTTP header works. Point it at the same URL and pass the header Authorization: Bearer dsk_…. For example, in Cursor (mcp.json):

{
  "mcpServers": {
    "doska": {
      "url": "https://getdoska.top/api/mcp",
      "headers": { "Authorization": "Bearer dsk_…" }
    }
  }
}

In VS Code (.vscode/mcp.json):

{
  "servers": {
    "doska": {
      "type": "http",
      "url": "https://getdoska.top/api/mcp",
      "headers": { "Authorization": "Bearer dsk_…" }
    }
  }
}

#Create a token

A token is personal: it acts as you and never has more rights than you have right now. If you are removed from a project or the organization, the token loses access there too.

A few more rules:

• A viewer stays a viewer. A Can edit token can't change boards where your role is Viewer.
• No management. A token can't delete boards or projects, manage members and roles, change sharing or create other tokens.
• Only the API and MCP. A token works for /api/v1/* and /api/mcp; other addresses answer 403.
• Stored as a hash. Doska keeps only a hash of the token. The dsk_ prefix helps secret scanners find leaked tokens.

Each token in the list shows its level, projects, expiration and when it was last used. Click the trash icon to revoke it; connected clients lose access immediately.

#For organization admins

In Members and settings → Access tokens, owners and admins choose what members and guests may create under Members and guests can create tokens: No restrictions, Read and comment, Read only or Tokens disabled. The rule applies immediately, including to tokens already issued. It doesn't limit admins and owners.

The same section lists every token in the organization with its owner, and any of them can be revoked.

#What the agent can do

The client sees only the tools of its token's level: a read-only token doesn't even get the editing tools.

#Can read

#Can comment

#Can edit

Diagram elements belong to their code, so the agent changes them only through put_diagram; your manual positions and styles are kept the same way as in the code editor. See Diagrams as code and Infrastructure.

#Ready-made prompts

Doska also gives the agent ready-made requests. In Claude Code they show up as commands after / (for example /mcp__doska__present-board); other clients list them in their own way.

#Example prompts

• "What boards are in the DevOps project?"
• "Read the Architecture board and explain how a request gets from the user to the database."
• "Draw a diagram of this service on the Payments board, based on the code in this repository."
• "Write a runbook for deploying this service as a new document in the Ops project."
• "Make a presentation from the Payments board for the architecture review, in the Midnight theme, and walk through the request flow step by step."
• "Reply to the open comments on the Review board."
• "Import our Terraform plan into the Network board and tell me which ports are open to the internet."

After a change the agent gives you a link to the board. If someone has the board open, the changes appear for them at once.

#Safety

• A version before changes. Before the first change through a token, Doska saves a copy of the board in its version history, labelled "Before changes via token "…"". Changes within the next 15 minutes continue the same session. To undo everything the agent did, restore that version in Version history.
• You can see who changed what. Diagram revisions made through MCP are signed "Name · MCP", and the agent's comments are marked "via MCP".
• Prompt injection. The agent reads sticky notes and comments written by other people, and they may contain "instructions". Doska tells the client that board content is data, not commands. The most reliable protection is the least privilege:
  • Can read is enough for questions and reviews;
  • limit Can edit tokens to the projects they need, and give them an expiration.
• Limits. Up to 300 MCP requests per minute from one address, 200 elements per call and 100 deletions per call.

#Troubleshooting

• 401 or "A valid Doska API token is required". The token was revoked, has expired or is disabled by the organization's rule. Check that the header is exactly Authorization: Bearer dsk_….
• "Board not found". The board is in a project the token doesn't include, or in another organization.

To test the server without a client:

curl -s https://getdoska.top/api/mcp \
  -H "Authorization: Bearer $DOSKA_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  --data '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

For CI and scripts, use the same tokens with the REST API.