Connect Your AI
Let the AI you already use — Claude Code, Cursor, any MCP or REST tool — read your site's Rover setup and propose changes. Every proposal waits for your review.
What This Is
Your site can mint scoped configuration keys. The AI you already use presents one to do exactly two things: read this site's Rover setup, and propose changes to it. Every proposal lands in your review inbox; nothing changes until you keep it.
Not a model key
This is not where you bring an OpenAI or Anthropic key — Rover's models stay managed for you. The key minted here reaches one thing only: this site's configuration.Three Ways to Connect
Cheapest first. Two of the three need no key at all.
1. Ask Rover in the Workspace
No setup. The same Rover window your visitors get floats inside the Workspace. It reads the area you're in, answers in plain language, and can draft for you. Drafting always asks first — a dialog names what will be staged. Journey drafts land in the review inbox as pending changes; scope guidance is staged in Customize for you to review and save.
| Where you are | What Rover can do there |
|---|---|
| Everywhere | Read the current area, check installation, read pending changes, open another area, open a pending change |
| Journeys | Draft a journey — demo, onboarding, support, or task — with up to 4 chapters |
| Knowledge | Start a read-only site scan (after you confirm) |
| Customize | Stage scope guidance for your review |
| Analytics | Read a seven-day summary — aggregate counts only, never individual visits |
| Journeys, Knowledge, Customize, Audience, Appearance | Propose a configuration change |
Rover's prompts and tool arguments never carry your site id, key, secret, or full configuration — it works through a short-lived, section-scoped context.
2. Copy for AI, Paste the Reply — No Key
Editors in Journeys, Knowledge, Appearance, Audience, and Analytics offer a Copy for AI button. It builds a brief — under 8 KB — with a plain-words intro to the section, your current values, the JSON shape to follow, and how to reply. You read exactly what your AI will get before you copy it.
Paste the brief into any assistant you already pay for. When it answers, bring the whole reply back through Paste a reply: Rover picks the fenced JSON out of the message (replies up to 128 KiB), checks it against the section's shape, and walks you through a before-and-after review. Fields Rover doesn't know are named and ignored — never silently dropped — and a typo gets a nearest-field suggestion. Keeping the changes uses the same versioned save as hand edits; if someone else edited meanwhile, you reload and review again.
The brief is redacted
Anything that looks like a token or password is removed before copy, owner actions and entitlements are dropped entirely, and resolver URLs collapse to their path. Your AI sees the shape of your setup, not your secrets.3. The Scoped Key — MCP or REST
For tools that work in your repo — Claude Code, Cursor, any agent that speaks MCP or plain HTTP. Mint the key once, paste the setup, then ask for changes in your own words. The rest of this page covers this lane.
Visiting agents need none of this
Your site also publishes AGENTS.md and llms.txt, so AI agents that visit learn what your site offers with no setup on their side. Manage those files from the Install area of the Workspace.Mint the Key
- 1
Create it
In your site's Workspace, open Connect AI and press Create the key. The key is scoped to this site only.
- 2
Copy the secret — shown once
Treat it like a password. Pressing I copied it clears the secret from the page for good — that was the only time it could be shown.
- 3
Paste the setup
The MCP and REST templates sit right below the key, ready to copy. Paste your key over
<YOUR-KEY>— everything else works as written.
Lost the secret? Rotate.
Rotate the existing connection instead of creating a second one. The old key stops working the moment its replacement exists, and the new secret is shown once. If the page tells you a secret never reached your browser, the same rule applies: rotate, don't duplicate.Every connection is listed with its label, the last four characters of its key, whether it's active, and when it was last used. Each one is bound to this site alone and stays active until you revoke it. A site may have up to eight active connections; revoke the ones you no longer use.
MCP Setup for Claude Code
Rover's configuration speaks MCP over HTTP. The server name is rover; authorization is your key as a bearer token.
{
"mcpServers": {
"rover": {
"type": "http",
"url": "https://us-central1-rtrvr-extension-functions.cloudfunctions.net/roverConfigMcp",
"headers": {
"Authorization": "Bearer <YOUR-KEY>"
}
}
}
}When you mint the key, the Workspace shows this snippet filled in and ready to copy, and the minted setup carries a Cursor variant too. Any MCP client that supports HTTP servers can use the same shape.
REST
Tools that don't speak MCP use plain HTTP against roverConfigApi/v1, with the same bearer key. Reading your site's setup:
curl -H 'Authorization: Bearer <YOUR-KEY>' 'https://us-central1-rtrvr-extension-functions.cloudfunctions.net/roverConfigApi/v1/sites/<YOUR-SITE-ID>/config'Reads return this site's Rover setup. Writes never touch it directly — they land as proposals in your review inbox.
Every Proposal Waits
Wherever a proposal comes from, it lands in the same place: the pending-changes review on your Workspace, which shows the exact count — "3 suggestions waiting" — and every waiting change in one list. Each change is labeled with its lane, so you always know who sent it.
| Lane | Who sent it |
|---|---|
| Site scan | A read-only scan of your own site |
| Curator | Suggestions Rover drafts for you |
| Outside tool | A connected AI — the scoped key over MCP or REST |
Each change shows what it touches in your words — Journeys, Knowledge, Appearance, Audience — with counts like "2 added · 1 updated". You have two moves: keep it or discard it. Applying is the publish — the save goes live on your site, with no separate publish step.
When a change can't apply, the review tells you why:
- Your setup moved on — the fields changed since the draft was written; the review names which ones.
- The draft no longer fits — discard it and ask for a fresh one.
- Someone else was editing — reload and review again.
- Already handled — a teammate (or another tab) applied or discarded it first.
Security Posture
- Scope — the key reaches this one site's configuration and nothing else. No visitor data, no billing, no other sites.
- Proposals only — nothing an outside tool writes goes live on its own. Every write becomes a pending change you apply or discard.
- Shown once — the secret appears a single time, at minting or rotation.
- Rotation — the old key stops working the moment its replacement exists.
- Revocation — requests using a revoked key stop immediately. It cannot be undone.