Publish your app as an MCP server

1. 1

   Open your app in Lovable and go to 'More' then 'Agent integrations'.

   This is where you manage the connection between your app and AI assistants.

2. 2

   Select 'Enable agent integrations'.

   This tells Lovable to create the special server and suggest actions (tools) your app can perform for AI assistants.

3. 3

   Choose who can connect to your app's features: either 'Protected with OAuth' (users sign in) or 'Public — no login' (anyone can use it).

   This sets the security level for your app's features when accessed by AI assistants. 'Protected' is the default and recommended for most apps.

4. 4

   Review the suggested tools in the 'AI tools' section and ask Lovable to add, remove, rename, or change them as needed.

   You control exactly which actions your app exposes to AI assistants and how they are described, ensuring clarity and security.

5. 5

   Publish your app.

   The connection to AI assistants only becomes active and available after your app is published.

6. 6

   Copy the 'MCP link' from the 'Your MCP link' card in 'More' -> 'Agent integrations' and share it with your users.

   This link is what users will add to their AI assistants to connect to your app.

Add Agent integrations to this app so users can connect it to AI assistants like ChatGPT and Claude. Make sure users have to sign in before their assistant can use the app's features.

MCP server

A special server that helps AI assistants understand what your app can do and how to ask it to perform actions.

Tools

Specific actions or capabilities your app offers, like 'look up an order' or 'generate a quote', that an AI assistant can call upon.

Agent integrations

The process of making your app's features available for use by AI assistants.

OAuth 2.1

A secure way for users to grant AI assistants permission to access their information or perform actions on their behalf in your app, without sharing their password.

Backend

The part of your app that runs on a server, handling data, logic, and user sign-ins, rather than what you see on screen.

Supabase

A service that provides a database and other backend features for your app.

Edge Function

A small piece of code that runs on servers close to users, making responses faster.

• Exposing sensitive data or actions that consume paid resources without proper sign-in or permission checks.
• Not reviewing each tool's action, inputs, returned data, and access checks before publishing.
• Allowing 'Public — no login' access for tools that should require user authentication, especially for workspace-published apps.
• Assuming interface-level controls (like hidden buttons) protect backend actions when accessed by AI assistants.
• Forgetting that users need to refresh their AI assistant connector when you add, remove, or rename tools in your app.
• Not understanding that agent integrations do not include built-in rate limits or spending caps, so your app must enforce these for resource-intensive actions.