Floot

Build, run and publish full-stack apps: write code, provision Postgres, run SQL, deploy live.

Add to Agentman Studio

Opens Agent Studio, where connecting is one click. The connector URL below works in any MCP client.

Paste it into any MCP client. Setup docs

Resources

What the Floot connector does

The Floot MCP server lets Claude, ChatGPT or any MCP-compatible agent build and publish full-stack web apps on Floot's infrastructure. Its 46 tools write React and TypeScript code, provision a Postgres database, run SQL, read logs, capture previews and deploy to a live URL. Sign-in is OAuth, and your assistant's own subscription pays for the thinking rather than Floot credits.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on .

Anthropic states this reflects the level of review a connector received, not a security audit.

Floot tools (46)

  • add_dependency
  • apply_patch
  • cancel_request
  • copy_file
  • create_project
  • delete_file
  • edit_file
  • execute_sql
  • fetch
  • generate_image
  • get_current_context
  • get_guide
  • get_guides
  • get_job_status
  • get_logs
  • get_preview_url
  • get_publish_status
  • list_files
  • list_projects
  • navigate_preview
  • provision_resource
  • publish_app
  • pull_database_schema
  • query_database
  • read_file
  • read_files
  • remove_dependency
  • rename_file
  • republish_app
  • request_external_resource
  • run_code_in_browser
  • run_code_in_vm
  • run_tests
  • search
  • search_code
  • typecheck
  • unpublish_app
  • update_project_metadata
  • upload_asset
  • view_annotation
  • write_file
  • create_checkpoint
  • request_user_upload
  • screenshot_preview
  • list_resources
  • card_upload_asset

Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.

Limits

  • No scope narrowing is possible. The authorization-server document declares scopes_supported: [] and the protected-resource descriptor omits the key. There is no read-only grant to choose — verified live, 2026-08-20.
  • A connected client reaches every project you own. Floot states this in its own before-you-connect list. A project another user shared with you additionally requires a paid Floot plan on your own account, for reading as well as writing.
  • Your app's user data reaches your AI provider. Floot's security page is explicit: if the database holds real user data, that data enters your assistant's context whenever a question requires it. Floot adds that the model writing your code is not Floot's — it runs under your own agreement with that provider, and the conversation is governed by their terms.
  • Three things have no tool at all. Turning on native mobile app builds has no tool and no publish parameter, so rephrasing will not help. Finishing a custom domain needs a browser DNS wizard and the link expires after one hour. The code export zip is assembled in your browser.
  • Standard ChatGPT reaches 2 of 46 tools. Floot states it registers the same full tool set for every client, and that ChatGPT's standard mode calls only tools named search and fetch by ChatGPT's own contract. Those two only search and read.
  • Build actions cap the work, not just the cost. Free accounts get 100 per UTC day plus a rolling 400 across seven days, and Floot notes that older credit-ladder plans are metered at those free caps despite being paid — "you are paying, and still getting the free caps", in Floot's words.
  • A production build is capped at 15 minutes of wall clock, after which the status check returns a definite failure rather than reporting the build as still running.
  • Preview links are unauthenticated by design. Floot documents that every preview URL carries a ptoken query parameter granting read and interaction rights for seven days with no login, so anyone the link is forwarded to can open it until it expires.
  • Published apps are public. Anyone with the live link can open the app unless the app itself requires login.
  • No tool schemas or annotations were read. The endpoint is OAuth-gated, so parameter detail, readOnlyHint, destructiveHint and idempotentHint are all unavailable. The read/write split above is our classification of published tool names, not the vendor's assertion.
  • Prompts and resources are unverified. The directory lists no prompts and records has_mcp_app: true, but the 401 blocked prompts/list and resources/list, so we make no claim about either surface.

Frequently asked questions

Do you need a paid Claude plan to add the Floot connector?

Yes. Floot's troubleshooting page states that adding connectors requires a paid Claude plan and that on Claude Free the option is not there to find. Any paid tier works. On Claude Team or Enterprise there is a second gate: an organization Owner must enable Floot once for the whole organization before individual members can click Connect for themselves.

Why does ChatGPT only search my Floot projects instead of editing them?

Because standard ChatGPT mode calls only two tools. Floot documents that standard ChatGPT can use only tools named search and fetch, which is ChatGPT's own contract rather than a Floot restriction — Floot states it registers the same full tool set for every client and holds nothing back. Those two tools only search and read projects. For writes, use a client that calls the full set.

Does the Floot MCP server need an API key or bearer token?

No. Floot documents OAuth as the only accepted method and tells you to leave bearer-token, API-key and custom-header fields empty, adding that a value typed into a token field is not a credential Floot accepts. Sign-in opens a Floot page in your browser. Floot also requires PKCE with S256, so a client offering only plain or no PKCE cannot connect at all.

Can the Floot connector spend money or change my plan?

No. Floot documents that nothing an assistant can call buys anything — there is no checkout tool, no plan-change tool, and no way for an agent to add a payment method. Floot calls this deliberate rather than an oversight. The one exception consumes credits you already hold: generate_image bills the project owner's balance, not the account driving the chat.

What can the Floot connector not do without opening a browser?

Three things, per Floot's capability matrix. Turning on native mobile app builds has no tool and no publish parameter at all. Finishing a custom domain needs you to complete a DNS wizard, and the link Floot hands you stays open for one hour. Downloading the code export zip is assembled in your browser rather than on Floot's servers.

How is Floot connector usage metered if building costs no credits?

In build actions — one per tool call your assistant makes, reads counted the same as writes. Floot's free plan allows 100 per UTC day plus 400 across a rolling seven-day window; Pro allows 1,000 a day and Power 5,000, neither with a weekly cap. Failed and cancelled calls never count, and six housekeeping tools are permanently exempt.

Can my AI assistant read the data in my Floot app's database?

Yes, and Floot says so plainly. Its security page states that query_database, execute_sql and pull_database_schema read rows from your app's database, and that if the database holds real user data, that data reaches your assistant's context whenever a question requires it. Resource secrets are the documented exception — those are never part of the payload an assistant sees.

Does Anthropic's directory publish a permissions label for the Floot connector?

No. The 2026-08-16 snapshot record carries no permissions field at all, on a connector whose 46 tool names include delete_file, execute_sql, publish_app and unpublish_app. Absence is not a read-only claim and it is not a write claim either — it means the reach of these tools was never summarised for the reader. Floot's own capability matrix fills that gap instead.

Sources

  • Floot MCP connector page, the URL Anthropic's directory nominates — https://floot.com/integrations/mcp (fetched 2026-08-20; HTTP 200, no redirects, 881 words of extracted text — the per-client connect steps, the "Permissions & privacy" four-point list, the Cowork recommendation with its own safety-pause caveat, and the five example prompts). The .md suffix form of this URL returns 404 · retrieved 2026-08-20
  • Floot documentation, complete corpus as one Markdown file — https://floot.com/llms-full.txt (fetched 2026-08-20; HTTP 200, 131,565 bytes, 21,434 words — the capability matrix naming 43 tools, the build-action limits and six exempt tools, the 13-question connector troubleshooting page, the OAuth/PKCE detail, the account limits table, and the security-and-data page) · retrieved 2026-08-20
  • Floot machine-readable documentation index — https://floot.com/llms.txt (fetched 2026-08-20; HTTP 200, 11,391 bytes — the "the connector is how building on Floot happens" framing, the endpoint and transport inline, the MCP registry name com.floot/floot, and the stack description). No licence or citation grant appears in the file · retrieved 2026-08-20
  • Floot MCP discovery manifest — https://floot.com/.well-known/mcp.json (fetched 2026-08-20; HTTP 200 — independently corroborates the endpoint, streamable-http transport and oauth2 auth type, and names both one-click install routes) · retrieved 2026-08-20
  • Live RFC 9728 protected-resource descriptor, root form — https://mcp.floot.com/.well-known/oauth-protected-resource (fetched 2026-08-20; HTTP 200, 128 bytes, application/json; resource is the real endpoint string, one authorization server, bearer_methods_supported: ["header"], and no scopes_supported key). This is the form the www-authenticate header names · retrieved 2026-08-20
  • Live RFC 9728 descriptor, path-append form — https://mcp.floot.com/.well-known/oauth-protected-resource/mcp (fetched 2026-08-20; HTTP 200, 128 bytes, body byte-identical to the root form, SHA-1 4ee3fbac8aae084042dce7606098a425d0a37d4a on both) · retrieved 2026-08-20
  • Live RFC 9728 descriptor, path-insert form — https://mcp.floot.com/mcp/.well-known/oauth-protected-resource (fetched 2026-08-20; HTTP 404, 13 bytes, text/plain) · retrieved 2026-08-20
  • Live RFC 8414 authorization-server metadata — https://mcp.floot.com/.well-known/oauth-authorization-server (fetched 2026-08-20; HTTP 200 — issuer, the https://floot.com/mcp-authorize consent screen, code_challenge_methods_supported: ["S256"], a registration endpoint, token_endpoint_auth_methods_supported: ["none"], and scopes_supported: [], present but empty). The openid-configuration form returns 404 · retrieved 2026-08-20
  • Live anonymous auth probe — 2026-08-20: an anonymous initialize POST to https://mcp.floot.com/mcp returns HTTP 401 with {"error":{"code":-32001,"message":"Unauthorized"}} and www-authenticate: Bearer resource_metadata="https://mcp.floot.com/.well-known/oauth-protected-resource", naming no scope. No tool was called · retrieved 2026-08-20
  • Floot crawl policy — https://floot.com/robots.txt (fetched 2026-08-20; Allow: / for the wildcard agent and for fourteen individually named AI crawlers including ClaudeBot, GPTBot and PerplexityBot; no Content-Signal line on any axis; the preamble itself advertises llms.txt, llms-full.txt and the .well-known/mcp.json manifest). Nothing on any axis restricts the use made of this page · retrieved 2026-08-20
  • Anthropic connector directory — https://claude.ai/directory/9efb767c-73f8-44c4-a1b3-ad7715e2b258 (snapshot 2026-08-16; 46 tool names, an empty prompt list, no permissions field, has_mcp_app: true, streamable HTTP, the mcp.floot.com/mcp endpoint, the developer-tools category, partner tier, and auth_posture: auth_required). The live directory page returns HTTP 403 Cloudflare interstitials to both curl and WebFetch, so the permissions-label check was made against the committed snapshot rather than the rendered page · retrieved 2026-08-16

More Developer Tools connectors

  • Base44

    Build and edit Base44 apps from an AI assistant, and query data your app's users submit.

  • CircleCI

    Diagnose failed builds, read job logs, inspect test results and rerun or roll back deployments from your AI assistant.

  • Claude Managed Agents

    Create, run, monitor and debug Anthropic's Claude Managed Agents from inside Claude itself.

Browse all MCP connectorsClaude and ChatGPT setup guideBrowse AI skills

Product names and logos belong to their owners. Agentman is not affiliated with a connector's maker unless the page says the connector is built and run by Agentman.

Use it in an agent

Put Floot to work.

Connect Floot once and your agents call these tools on their own: on a schedule, in a workflow, with nobody at the keyboard.

Open in Agentman Studio