Connect product feedback to an AI coding agent with MCP

Understand the access boundary

The private MCP key scopes the agent to one project’s feedback, statuses, labels, boards, and comments. It is separate from the publishable SDK key embedded in your app.

• Do not commit an MCP key to Git.
• Store it in your shell environment or MCP client secret store.
• Rotate it from the MCP tab if it is exposed.

Configure Claude Code

Claude Code can add the hosted MCP server through its command line. Generate a private key from the MCP tab and keep it outside your repository.

claude mcp add --transport http upstep https://upstep.dev/api/mcp \
  --header "Authorization: Bearer YOUR_MCP_KEY"

Configure Codex

For Codex, keep the MCP key in an environment variable and let the MCP configuration reference it. This is safer than storing a bearer token in a checked-in configuration file.

export UPSTEP_MCP_KEY="upstep_mcp_your_private_key"
codex mcp add upstep --url https://upstep.dev/api/mcp \
  --bearer-token-env-var UPSTEP_MCP_KEY

Configure another Streamable HTTP MCP client

Most clients accept an MCP server URL plus a Bearer authorization header. Check your client’s current MCP configuration format, then point it at the hosted endpoint.

{
  "mcpServers": {
    "upstep": {
      "url": "https://upstep.dev/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_MCP_KEY"
      }
    }
  }
}

Verify the connection with read-only triage

Start with a request that does not change feedback. The overview contains counts, board columns, and leading open items; listing feedback lets you filter by status, type, votes, or search text.

Use Upstep to:
1. Get a project overview.
2. List the 20 highest-voted open requests.
3. Group likely duplicates, but do not change anything.
4. Return a short triage report with links or IDs for every recommendation.

Use a safe mutation workflow

Once the read-only output is useful, let the agent make bounded changes. Ask it to create internal tasks by default so agent-generated work stays hidden from users until a human explicitly publishes it. Require a review summary after every mutation.

• create_feedback defaults to internal: true.
• update_feedback can move work by board-column name.
• add_comment posts a customer-visible team comment, so reserve it for reviewed responses.

Review the top three requests. For each one:
- create an internal task only if no equivalent internal task exists;
- label it "triage";
- do not change customer-visible request titles or status;
- finish with a table of every created task and why it was created.

Build a weekly feedback ritual

MCP is most useful as a repeatable review step, not a replacement for product judgment. Use the agent to reduce reading and grouping work, then let a product owner decide what becomes public roadmap work.