Floot
by Floot
Build, run and publish full-stack apps from your AI assistant: write code, provision a Postgres database, run SQL, and deploy to a live URL. 46 tools, OAuth sign-in, and 25 of those tools write. Floot's own documentation states no tool can spend your money.
Verified connector
Listed by Anthropic as a partner connector in its Connectors Directory.
Connection checked by Agentman on .
Anthropic states this reflects the level of review a connector received, not a security audit.
Connect Floot via MCP
https://mcp.floot.com/mcpWorks in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.
Floot Tools & Capabilities (46)
Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.
Limits
- No scope narrowing is possible. The authorization-server document declares
scopes_supported: []and the protected-resource descriptor omits the key. There is no read-only grant to choose — verified live, 2026-08-20. - A connected client reaches every project you own. Floot states this in its own before-you-connect list. A project another user shared with you additionally requires a paid Floot plan on your own account, for reading as well as writing.
- Your app's user data reaches your AI provider. Floot's security page is explicit: if the database holds real user data, that data enters your assistant's context whenever a question requires it. Floot adds that the model writing your code is not Floot's — it runs under your own agreement with that provider, and the conversation is governed by their terms.
- Three things have no tool at all. Turning on native mobile app builds has no tool and no publish parameter, so rephrasing will not help. Finishing a custom domain needs a browser DNS wizard and the link expires after one hour. The code export zip is assembled in your browser.
- Standard ChatGPT reaches 2 of 46 tools. Floot states it registers the same full tool set for every client, and that ChatGPT's standard mode calls only tools named
searchandfetchby ChatGPT's own contract. Those two only search and read. - Build actions cap the work, not just the cost. Free accounts get 100 per UTC day plus a rolling 400 across seven days, and Floot notes that older credit-ladder plans are metered at those free caps despite being paid — "you are paying, and still getting the free caps", in Floot's words.
- A production build is capped at 15 minutes of wall clock, after which the status check returns a definite failure rather than reporting the build as still running.
- Preview links are unauthenticated by design. Floot documents that every preview URL carries a
ptokenquery parameter granting read and interaction rights for seven days with no login, so anyone the link is forwarded to can open it until it expires. - Published apps are public. Anyone with the live link can open the app unless the app itself requires login.
- No tool schemas or annotations were read. The endpoint is OAuth-gated, so parameter detail,
readOnlyHint,destructiveHintandidempotentHintare all unavailable. The read/write split above is our classification of published tool names, not the vendor's assertion. - Prompts and resources are unverified. The directory lists no prompts and records
has_mcp_app: true, but the 401 blockedprompts/listandresources/list, so we make no claim about either surface.
Frequently asked questions
Do you need a paid Claude plan to add the Floot connector?
Yes. Floot's troubleshooting page states that adding connectors requires a paid Claude plan and that on Claude Free the option is not there to find. Any paid tier works. On Claude Team or Enterprise there is a second gate: an organization Owner must enable Floot once for the whole organization before individual members can click Connect for themselves.
Why does ChatGPT only search my Floot projects instead of editing them?
Because standard ChatGPT mode calls only two tools. Floot documents that standard ChatGPT can use only tools named search and fetch, which is ChatGPT's own contract rather than a Floot restriction — Floot states it registers the same full tool set for every client and holds nothing back. Those two tools only search and read projects. For writes, use a client that calls the full set.
Does the Floot MCP server need an API key or bearer token?
No. Floot documents OAuth as the only accepted method and tells you to leave bearer-token, API-key and custom-header fields empty, adding that a value typed into a token field is not a credential Floot accepts. Sign-in opens a Floot page in your browser. Floot also requires PKCE with S256, so a client offering only plain or no PKCE cannot connect at all.
Can the Floot connector spend money or change my plan?
No. Floot documents that nothing an assistant can call buys anything — there is no checkout tool, no plan-change tool, and no way for an agent to add a payment method. Floot calls this deliberate rather than an oversight. The one exception consumes credits you already hold: generate_image bills the project owner's balance, not the account driving the chat.
What can the Floot connector not do without opening a browser?
Three things, per Floot's capability matrix. Turning on native mobile app builds has no tool and no publish parameter at all. Finishing a custom domain needs you to complete a DNS wizard, and the link Floot hands you stays open for one hour. Downloading the code export zip is assembled in your browser rather than on Floot's servers.
How is Floot connector usage metered if building costs no credits?
In build actions — one per tool call your assistant makes, reads counted the same as writes. Floot's free plan allows 100 per UTC day plus 400 across a rolling seven-day window; Pro allows 1,000 a day and Power 5,000, neither with a weekly cap. Failed and cancelled calls never count, and six housekeeping tools are permanently exempt.
Can my AI assistant read the data in my Floot app's database?
Yes, and Floot says so plainly. Its security page states that query_database, execute_sql and pull_database_schema read rows from your app's database, and that if the database holds real user data, that data reaches your assistant's context whenever a question requires it. Resource secrets are the documented exception — those are never part of the payload an assistant sees.
Does Anthropic's directory publish a permissions label for the Floot connector?
No. The 2026-08-16 snapshot record carries no permissions field at all, on a connector whose 46 tool names include delete_file, execute_sql, publish_app and unpublish_app. Absence is not a read-only claim and it is not a write claim either — it means the reach of these tools was never summarised for the reader. Floot's own capability matrix fills that gap instead.
Sources
- Floot MCP connector page, the URL Anthropic's directory nominates — https://floot.com/integrations/mcp (fetched 2026-08-20; HTTP 200, no redirects, 881 words of extracted text — the per-client connect steps, the "Permissions & privacy" four-point list, the Cowork recommendation with its own safety-pause caveat, and the five example prompts). The
.mdsuffix form of this URL returns 404 · retrieved 2026-08-20 - Floot documentation, complete corpus as one Markdown file — https://floot.com/llms-full.txt (fetched 2026-08-20; HTTP 200, 131,565 bytes, 21,434 words — the capability matrix naming 43 tools, the build-action limits and six exempt tools, the 13-question connector troubleshooting page, the OAuth/PKCE detail, the account limits table, and the security-and-data page) · retrieved 2026-08-20
- Floot machine-readable documentation index — https://floot.com/llms.txt (fetched 2026-08-20; HTTP 200, 11,391 bytes — the "the connector is how building on Floot happens" framing, the endpoint and transport inline, the MCP registry name
com.floot/floot, and the stack description). No licence or citation grant appears in the file · retrieved 2026-08-20 - Floot MCP discovery manifest — https://floot.com/.well-known/mcp.json (fetched 2026-08-20; HTTP 200 — independently corroborates the endpoint,
streamable-httptransport andoauth2auth type, and names both one-click install routes) · retrieved 2026-08-20 - Live RFC 9728 protected-resource descriptor, root form — https://mcp.floot.com/.well-known/oauth-protected-resource (fetched 2026-08-20; HTTP 200, 128 bytes,
application/json;resourceis the real endpoint string, one authorization server,bearer_methods_supported: ["header"], and noscopes_supportedkey). This is the form thewww-authenticateheader names · retrieved 2026-08-20 - Live RFC 9728 descriptor, path-append form — https://mcp.floot.com/.well-known/oauth-protected-resource/mcp (fetched 2026-08-20; HTTP 200, 128 bytes, body byte-identical to the root form, SHA-1
4ee3fbac8aae084042dce7606098a425d0a37d4aon both) · retrieved 2026-08-20 - Live RFC 9728 descriptor, path-insert form — https://mcp.floot.com/mcp/.well-known/oauth-protected-resource (fetched 2026-08-20; HTTP 404, 13 bytes,
text/plain) · retrieved 2026-08-20 - Live RFC 8414 authorization-server metadata — https://mcp.floot.com/.well-known/oauth-authorization-server (fetched 2026-08-20; HTTP 200 — issuer, the
https://floot.com/mcp-authorizeconsent screen,code_challenge_methods_supported: ["S256"], a registration endpoint,token_endpoint_auth_methods_supported: ["none"], andscopes_supported: [], present but empty). Theopenid-configurationform returns 404 · retrieved 2026-08-20 - Live anonymous auth probe — 2026-08-20: an anonymous
initializePOST tohttps://mcp.floot.com/mcpreturns HTTP 401 with{"error":{"code":-32001,"message":"Unauthorized"}}andwww-authenticate: Bearer resource_metadata="https://mcp.floot.com/.well-known/oauth-protected-resource", naming no scope. No tool was called · retrieved 2026-08-20 - Floot crawl policy — https://floot.com/robots.txt (fetched 2026-08-20;
Allow: /for the wildcard agent and for fourteen individually named AI crawlers including ClaudeBot, GPTBot and PerplexityBot; noContent-Signalline on any axis; the preamble itself advertisesllms.txt,llms-full.txtand the.well-known/mcp.jsonmanifest). Nothing on any axis restricts the use made of this page · retrieved 2026-08-20 - Anthropic connector directory — https://claude.ai/directory/9efb767c-73f8-44c4-a1b3-ad7715e2b258 (snapshot 2026-08-16; 46 tool names, an empty prompt list, no permissions field,
has_mcp_app: true, streamable HTTP, themcp.floot.com/mcpendpoint, the developer-tools category, partner tier, andauth_posture: auth_required). The live directory page returns HTTP 403 Cloudflare interstitials to both curl and WebFetch, so the permissions-label check was made against the committed snapshot rather than the rendered page · retrieved 2026-08-16
Use in Agentman
Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.
Open in Agentman StudioServer Info
- Category
- Developer Tools
- Developer
- Floot
- Tools
- 46
- Domain
- mcp.floot.com
Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.