Connect your agent

Tofu's client is a local stdio MCP bridge: your agent runs it, and it reaches the same authenticated control plane as the dashboard. Node.js 22 or newer is required.

Start on the setup page, pick your coding agent (Another agent covers any agent not listed), and paste the setup prompt into it. The prompt carries the size and SHA-256 of the client and the skill, and asks your agent to stop, running nothing, if a download does not match.

TOFU_URL selects the exact trusted origin (HTTPS, or loopback in development) and TOFU_CLIENT names the connection and grants nothing; setup emits argv and configuration without touching your agent settings, and installs the client and skill privately.

A saved credential alone is not proof of connection: the client checks with Tofu. When a host has not picked up a new MCP server in the session it is already in, the installed client’s own command line does the same work without one — see the skill’s Installation and CLI fallback — and the connection is there the next time that host starts.

Add the address as a custom connector or remote MCP server; your host then opens Tofu's own page, where you approve the connection, and nothing is pasted. In claude.ai, this link opens the add-connector dialog with Tofu's name and address filled in (it does not fill them in on iPhone). The connection appears on the dashboard's Coding agent page, where Disconnect ends it.

Step by step for Claude and ChatGPT, with reconnecting and troubleshooting: Use Tofu in Claude or ChatGPT.

The connection lasts seven days and is revoked on the dashboard's Coding agent page; only a hash of the credential is stored.

The bridge exposes 91 tools, 13 by default: your agent loads those thirteen, and reaches every other tool as a command of the same installed client, or loads all of them with TOFU_TOOLS=all, which setup <host> --tools all writes into the host's registration.

listEnv returns names and scopes and no values. setPublicEnv and deletePublicEnv save and remove a public value — an address, a feature flag, a key meant to be public — and Tofu refuses one that looks like a secret; a secret is entered in the dashboard. Nothing here can change billing, buy or transfer a domain, or run SQL. In a zone the owner keeps elsewhere, DNS is written only through an approval the owner gave on the provider's own screen: domainAuthorize hands the owner that link, after which Tofu writes the records the connection asked for, and appAuthEmailConnect writes the six sending records into a zone only when that approval exists, reporting them to publish by hand otherwise. A domain bought through Tofu sits in Tofu's own registrar account, so domainRecordAdd and domainRecordDelete change the owner's records there, keeping a copy of the zone first; they never touch the records Tofu keeps for the site, and an agent never deletes a mail (MX) or verification (TXT) record.

builderLink answers whether the Tofu builder can open one of your apps and, when it can, hands your agent the link that opens it, for you to open yourself, signed in. It changes nothing, and when the builder cannot open that app, the answer says why. No coding agent is needed for the builder itself: Tofu builder is the other way in.

The five payments tools connect an app to the owner's own Stripe account through Tofu's Stripe app, on the installed client only. appPaymentsConnect hands the owner a link to Tofu's own page, which they open signed in, and Stripe's page installs the app in the account they choose — nobody types a key. appPaymentsSetup saves the secret the app verifies its payment events with, and appPaymentsLinkCreate makes a product, its price and a Payment Link in that account. The money goes to the owner's account, never through Tofu, and refunds, payouts and disputes stay in their Stripe Dashboard, where no tool reaches.

These tools need a literal confirmed: true for the exact project or connection they act on — an earlier deploy, scan or upload is not that agreement, and without the literal nothing is sent:

deploy with database: true creates a database in the same call; the flag itself is that agreement, so it is sent only after you agreed to a database for that exact app. setPublicEnv asks for confirmed: true only to change a key that already holds a public value — its value or its scopes; saving a new one needs nothing more.

databaseDelete and databaseRestore ask for the app's own name instead of a literal. The first removes one managed database this account owns — the data, the schema and the Supabase project behind it, permanently, and the delete keeps no copy (for an archived database, every copy Tofu holds for the app goes with it; a copy Tofu already holds for a running one, such as the archive it was brought back from, is untouched); the second puts an archived database back into a new one Tofu runs and pays for, which needs the account's plan to include a managed database for the app: the paid plans do, and so does the Free plan where Tofu offers its one database, for an app that is live. Both refuse a name that is not that app's own. databaseArchiveDownload hands the owner two links to an archived database's stored copy that work for about ten minutes, and changes nothing. databaseKeep is the Database page's Keep this database: it counts as use of that app's database, so an inactivity warning (databaseStatus's inactivity) ends. It works for a paying account. The Free plan's own database needs none: Tofu keeps it and never archives it for going unused. A database warned because a free trial ended is kept by starting a paid plan.

databaseBackups lists a running database's daily backups — one a day, kept for seven days — and changes nothing. databaseRestoreRequest asks a person at Tofu to put the database back to one of them: it emails the request and sends you a confirmation, and nothing changes until that person does the restore and emails you. Replying to the confirmation before then cancels it.

• Report a problem in the dashboard. Signed in, choose Report a problem in the account menu at the foot of the sidebar, or open app.trytofu.ai/dashboard/report. Say what happened and pick the kind of problem; opened inside an app, the form adds that app’s status unless you untick Include my app’s details. A person at Tofu reads every report, and Tofu keeps it for 180 days.
• Ask your coding agent or AI app to report it. It shows you the exact words first, and reportProblem sends them only once you agree, with your app’s status unless you leave it out. Tofu emails you a receipt: reply to it to add something or to withdraw the report. When Tofu cannot email one, its answer says so: write to us with the report’s reference instead.
• Write to us. For a question, for anything that is not a problem in Tofu itself, when you cannot sign in, or when the report page or your agent says Tofu isn’t taking problem reports: hello@trytofu.ai.
• A security vulnerability. Report it the way the security page’s Report a vulnerability describes; the same address is in /.well-known/security.txt.