Developer tools

Editors and CLIs that speak MCP over HTTP take Pelyr with a bearer header. They do not use the browser sign-in: Pelyr deliberately offers no dynamic client registration, and the header route needs no registration at all.

Create a key with the https capability in the portal first. What happens next differs by client — not every one of them expands an environment variable inside a header the same way, so this page gives you the form each client actually documents rather than one block for all four.

Cursor

~/.cursor/mcp.json, or .cursor/mcp.json in the project:

{
  "mcpServers": {
    "pelyr": {
      "url": "https://api.pelyr.com/mcp",
      "headers": { "Authorization": "Bearer ${env:PELYR_API_KEY}" }
    }
  }
}

export PELYR_API_KEY=pk_your_key_here

Export the variable in the shell Cursor starts from — Cursor's own docs describe ${env:...} resolving inside headers for a remote server like this one.

VS Code

.vscode/mcp.json in the project. The object is called servers, and each entry carries "type": "http":

{
  "inputs": [
    { "type": "promptString", "id": "pelyr-api-key", "password": true }
  ],
  "servers": {
    "pelyr": {
      "type": "http",
      "url": "https://api.pelyr.com/mcp",
      "headers": { "Authorization": "Bearer ${input:pelyr-api-key}" }
    }
  }
}

VS Code's own recommended way to keep a header secret out of the file is an input that prompts once and stores the value, not an environment-variable reference — see VS Code's MCP documentation for the current syntax.

Gemini CLI

export PELYR_API_KEY=pk_your_key_here
gemini mcp add --scope user --transport http pelyr https://api.pelyr.com/mcp --header 'Authorization: Bearer $PELYR_API_KEY'

--scope user writes the server into ~/.gemini/settings.json. Without it, Gemini CLI writes .gemini/settings.json in the current project directory, a file that is easy to commit. The single quotes keep your shell from expanding the reference, so the file stores the literal $PELYR_API_KEY. Gemini CLI resolves $VAR and ${VAR} in every string of settings.json when it loads the settings, headers included. This command does not write the key itself into the file.

One caveat: a later gemini mcp add or gemini mcp remove in the same scope, run while PELYR_API_KEY is set, can write the resolved key back into the file. Check the file afterwards.

Windsurf

~/.codeium/windsurf/mcp_config.json. The URL field is called serverUrl:

{
  "mcpServers": {
    "pelyr": {
      "serverUrl": "https://api.pelyr.com/mcp",
      "headers": { "Authorization": "Bearer ${env:PELYR_API_KEY}" }
    }
  }
}

export PELYR_API_KEY=pk_your_key_here

Windsurf's own docs describe ${env:...} resolving inside both serverUrl and headers.

Never write the key into the file itself where the client actually substitutes a reference for you. A key that has been committed once is a key to revoke.

Checking the connection

Every one of these clients lists the tools of a server it connected to. pelyr has to show ten: list_sources, find_vessels, get_vessel, get_vessel_track, vessels_at_time, search_vessels, list_detection_areas, list_detection_overflights, get_detection_overflight, list_sts_finds.

An empty list means the server refused the key: missing header, revoked key, or a key without the https capability. The server answers 401 in all three cases and says so in the WWW-Authenticate header; most clients show that as "not authenticated".