SpringRoll

How it works

Install the skill. Ask it to deploy. Share the URL.

Install the SpringRoll skill in the coding agent you already use, then ask it to deploy your AI-built app. SpringRoll hosts the app and returns a live URL you can share with your team. When the app is ready, you can securely connect it to approved company data without exposing source credentials.

Recommended setup

Install the skill, then ask for the outcome.

The SpringRoll skill covers the full control plane: app records, deployment, promotion, approvals, governed data access, and provenance. On the first live operation, your MCP client opens a browser so you can choose an organization and authorize it; there is no token to copy or store.

Recommended

Install the SpringRoll skill.

One command teaches your coding agent the complete SpringRoll workflow: applications, deployments, approvals, governed data access, and provenance. Install it, then ask for the outcome you need.

npx skills add springroll-dev/springroll-skill --skill springroll

Advanced: connect SpringRoll MCP manually

Choose your client to configure and authorize the SpringRoll MCP endpoint yourself.

Terminal. One command, then authorize.

01
Add SpringRoll
Run this once, from anywhere.
```
claude mcp add --transport http springroll https://springroll.dev/api/mcp
```
Then start Claude and authorize. Your browser opens by itself.
```
/mcp
```
02
Authorize
Choose your organization in the browser and approve the connection. No credential is exposed for you to store.
03
Deploy
Ask the agent to register, validate, and deploy the project.
```
/springroll deploy
```

Also claude.ai. Added as a custom connector.

Custom connectors are a paid feature on Claude — Pro, Max, Team, or Enterprise.

01
Add SpringRoll
Open Settings, then Connectors.
Choose Add custom connector.
Name
```
SpringRoll
```
URL
```
https://springroll.dev/api/mcp
```
Save, then connect. Claude opens this authorization page itself.
02
Authorize
Choose your organization in the browser and approve the connection. No credential is exposed for you to store.
03
Deploy
Ask the agent to register, validate, and deploy the project.
```
Deploy this project to SpringRoll.
```

Web. Needs developer mode turned on first.

Connectors are available on ChatGPT Pro and Plus on the web. Use your public SpringRoll MCP endpoint below; ChatGPT must be able to reach it over the internet.

01
Add SpringRoll
In Settings, open Connectors, then Advanced settings, and turn on Developer mode.
Back in Connectors, choose Create.
Name
```
SpringRoll
```
MCP server URL
```
https://springroll.dev/api/mcp
```
Authentication
```
OAuth
```
Create, then authorize. The connector appears under Developer mode in the composer.
02
Authorize
Choose your organization in the browser and approve the connection. No credential is exposed for you to store.
03
Deploy
Ask the agent to register, validate, and deploy the project.
```
Deploy this project to SpringRoll.
```

Terminal. The CLI finds the authorization server itself.

01
Add SpringRoll
Run this once. Codex probes the URL, sees it supports OAuth, and opens your browser.
```
codex mcp add springroll --url https://springroll.dev/api/mcp
```
The entry is written to ~/.codex/config.toml. Add it inside a project to scope it to that project instead.
02
Authorize
Choose your organization in the browser and approve the connection. No credential is exposed for you to store.
03
Deploy
Ask the agent to register, validate, and deploy the project.
```
Deploy this project to SpringRoll.
```

Editor and CLI. One project file, then OAuth login.

01
Add SpringRoll
Create .cursor/mcp.json in your project. Cursor and Cursor Agent both read this file.
.cursor/mcp.json
```
{"mcpServers":{"springroll":{"url":"https://springroll.dev/api/mcp"}}}
```
Authorize SpringRoll from Cursor Agent. Your browser opens for organization approval.
```
cursor-agent mcp login springroll
```
02
Authorize
Choose your organization in the browser and approve the connection. No credential is exposed for you to store.
03
Deploy
Ask the agent to register, validate, and deploy the project.
```
Deploy this project to SpringRoll.
```

One URL. Nothing else to configure.

01
Add SpringRoll
Remote MCP endpoint
```
https://springroll.dev/api/mcp
```
Any MCP client that speaks streamable HTTP can be pointed straight at this URL. It still opens a browser to authorize — the endpoint advertises its own authorization server, so the URL is the only thing to configure.
Clients that register a private-use redirect scheme without a dot in it are refused at registration. Use a client path with an HTTPS, loopback, or reverse-domain callback.
02
Authorize
Choose your organization in the browser and approve the connection. No credential is exposed for you to store.
03
Deploy
Ask the agent to register, validate, and deploy the project.
```
Deploy this project to SpringRoll.
```

The simplified MCP flow

One deploy call does the heavy lifting.

01springroll.context
Check which organization you are acting in and what you are allowed to do.
02springroll.deploy
Register the app, capture its release, and start the deployment in one call.
03springroll.deploy.status
Follow the build and get the public URL when it is ready.
04springroll.approval.submit
Request production approval when your organization requires it.
05springroll.deploy.promote
Promote the approved release to production.
06springroll.connect.data_products
Find the company data products available to the app.
07springroll.connect.request_access
Request a governed view of a data product for the app.
08springroll.connect.access_status
Check the grant and learn what the approved app can query.

The everyday path is context, deploy, then status. SpringRoll creates the app record and release as part of the deploy call. Approval is optional by organization policy; Connect stays separate so data access can be granted, limited, or revoked without redeploying the app.

Security

The controls stay in the request path.

Security is built into the route between an app and your data. SpringRoll checks the organization, the person, the app identity, and the approved data rules on every request. Change or revoke a grant and the next request follows the new rule; the audit trail shows who changed it.

01
Tenant isolation
Every tenant-owned record carries tenant_id. The scoped data layer injects it, PostgreSQL RLS checks it again, and pages obtain context through verified membership.
02
Governed release
Tenant Admins choose Direct to Production or a staged approval route. Automated production safety checks and governed data controls apply in both modes.
03
App Identity
Each application environment receives a service identity independent from the builder and from the source system.
04
Secrets boundary
Connector and runtime credentials are encrypted at rest and write-only in the interface. Applications never receive source-system credentials.
05
Revocation
Agent connections, access grants, memberships, and application identities can be revoked without changing the upstream source credential.
06
Authentication
Auth.js sessions resolve live memberships on each request. Enterprise identity supports OIDC/SAML and directory provisioning supports SCIM.
07
Audit integrity
An operation and its audit event share one transaction. Events are append-only, ordered per tenant, and hash-chained so removal or alteration is detectable.

These are current product controls. SpringRoll does not claim a certification, compliance status, or uptime figure here.

Ship your first app.

Install the skill. Ask it to deploy. Share the URL.

Install the skill, then ask for the outcome.

Install the SpringRoll skill.

Add SpringRoll

Authorize

Deploy

Add SpringRoll

Authorize

Deploy

Add SpringRoll

Authorize

Deploy

Add SpringRoll

Authorize

Deploy

Add SpringRoll

Authorize

Deploy

Add SpringRoll

Authorize

Deploy

One deploy call does the heavy lifting.

The controls stay in the request path.

Tenant isolation

Governed release

App Identity

Secrets boundary

Revocation

Authentication

Audit integrity

Connect an agent and ship to production in minutes.