Set your bot up by talking to your own AI assistant.

What this actually is

Scode exposes an MCP server — a small program your assistant runs — that lets it read and write your bot's configuration through the Scode API. It is a setup tool, not the bot itself.

The bot that answers your customers runs inside Scode on a fast, inexpensive model. This is a separate surface, and the split is the whole idea: the thing that decides support quality is the knowledge and the action descriptions, not the model reading them back. So it is worth pointing a strong assistant at that preparation work, even though a small one serves the result to customers.

Getting started

1. Create a management key

   In the dashboard, open Settings → Management keys (owner only) and create one. Tick only the permissions the job needs — see below. You'll see the key once.

2. Copy the setup config

   The same dialog gives you a ready-to-paste configuration block with the key already in it. It looks like this:

   {
     "mcpServers": {
       "scode-setup": {
         "command": "npx",
         "args": ["-y", "@scode/mcp-server"],
         "env": {
           "SCODE_MANAGEMENT_KEY": "smk_your_key_from_the_dashboard",
           "SCODE_API_URL": "https://api.ai.scode.iq"
         }
       }
     }
   }

   Paste it into your assistant's MCP configuration. (In Claude Desktop or Claude Code, that is the mcpServers section of its config file.) The npx line fetches and runs the server for you — nothing to install by hand.

3. Talk to it

   Ask for what you want in plain language. It will check what it's allowed to do first, then get to work.

   # then just talk to your assistant in plain language:
   
   "Here's my furniture shop. Crawl zanhome.iq, add a Q&A
    for our Basra delivery fee, then test it in Iraqi Arabic
    and tell me anything the bot gets wrong."

Permissions (scopes)

A key does only what you ticked — nothing more. Each permission is granted on its own, so you can hand an agency the ability to build knowledge without also letting it point your bot at outside systems.

What a key can never do

The list above is the entire reach of a management key. Everything else is unreachable — not by a rule someone remembered to add, but because those parts of Scode were never opened to this kind of key at all.

Is it safe? Will it expose my keys?

No — and the design goes out of its way to make sure of it. Three things worth knowing:

Your own API credentials stay hidden

If an AI Action carries a secret — say an authorization header for your order system — that value is redacted before it ever reaches a management key. The assistant can see which header an action sends (so it can help you wire and test it) but not the secret inside. Your Gemini, Voyage, or provider keys aren't part of this surface at all; they live in the server environment and no key can read them.

A management key is its own kind of credential

It starts with smk_, travels in its own header, and is stored only as a hash — Scode can't show it to you again after creation, and neither can anyone who gets into the database. It is deliberately not the same as your public widget key, so the two can never be confused for one another.

You stay in control

The tools it has

Sixteen in total — six that read, ten that write, and none that delete. You don't call these yourself; your assistant does, based on what you ask for. They map onto the permissions above.

Reading

Writing