Install the Squig MCP server

The fast path: paste the invitation

You do not have to install anything to start. In the canvas, Connect agent copies an invitation block; paste it into your agent's chat. It carries the canvas link, a key scoped to that one canvas, the MCP and REST addresses, and the first instruction. An agent that can make HTTP requests sends the key as Authorization: Bearer and calls REST straight away: read the canvas first, then edit in small batches so the person watching sees the work appear. An agent with MCP support can add the server from the same addresses. Treat the block as a secret; it grants edit access to that canvas.

Wireframe with me in Squig.
Canvas: https://squig.sh/?agent=DOCUMENT_ID
Key: sq_canvas_XXXX (send as Authorization: Bearer; scoped to this canvas; keep it private)
MCP: https://squig.sh/mcp · REST: https://squig.sh/api/v1 · Agent guide: https://squig.sh/llms.txt
Start by reading the canvas (squig_get_document, or GET /api/v1/documents/DOCUMENT_ID), then edit in small batches so I can watch.

Reading the canvas with the pasted key

This is the whole first step over REST. The same command is squig_get_document through MCP. POST /api/v1/tools/{name} runs every other command with the same JSON input.

curl https://squig.sh/api/v1/documents/DOCUMENT_ID \
  -H "Authorization: Bearer sq_canvas_XXXX"

Server and authentication

The server is https://squig.sh/mcp on a deployed instance, or your own instance’s /mcp endpoint. Get a canvas key from Connect agent in the editor, or a workspace key at /connect to create and manage multiple canvases. Every request requires Authorization: Bearer <key>. This release uses bearer keys, not an OAuth login flow. Clients that only support OAuth cannot connect directly. The server is stateless Streamable HTTP with JSON responses; it does not offer legacy SSE or a persistent event stream.

Codex

Set SQUIG_API_KEY in the environment that launches Codex. Avoid putting the key in source control or pasting it into a task. Then run:

codex mcp add squig --url https://squig.sh/mcp --bearer-token-env-var SQUIG_API_KEY

Codex configuration file

The equivalent entry in ~/.codex/config.toml is below. Restart or reconnect the client after changing its environment or MCP configuration.

[mcp_servers.squig]
url = "https://squig.sh/mcp"
bearer_token_env_var = "SQUIG_API_KEY"

Claude Code

Set SQUIG_API_KEY privately in your shell, then add the HTTP server. Claude Code stores the expanded header in its local MCP configuration; protect that file. Use user scope to keep it out of the repository.

claude mcp add --transport http --scope user squig https://squig.sh/mcp --header "Authorization: Bearer $SQUIG_API_KEY"

Cursor and generic MCP clients

Use this server entry in a private MCP configuration. Replace YOUR_SQUIG_KEY locally. Cursor supports remote HTTP servers through the url field. Do not commit a configuration containing a key.

{
  "mcpServers": {
    "squig": {
      "url": "https://squig.sh/mcp",
      "headers": { "Authorization": "Bearer YOUR_SQUIG_KEY" }
    }
  }
}

Tools, resources and prompts

Every API command is also an MCP tool with a squig_ prefix. Start with squig_documents to continue an existing canvas, or squig_create_document with a workspace key for a new one. Return canvasUrl before drawing; use small coherent batches so the user sees progress. Responses stay small on purpose: squig_catalog with no arguments returns a compact index of kinds, and a query or kind adds defaults and editable controls; squig_edit_document returns the new revision with only the nodes the batch created, changed or deleted, so read squig_get_document when you need the whole canvas. The server exposes squig://guides/wireframing as a text resource and wireframe-first as a prompt. Tool schemas include descriptions and read-only/destructive annotations. Tool errors carry isError with an HTTP-style status and an actionable message.

Troubleshooting

401 means the key is missing, invalid or rotated. 403 means the key lacks the required scope or a browser origin is not allowed. 409 means the document revision changed; read it and reconcile. 429 means the request quota was reached. 503 means the instance’s database is not configured. A GET /mcp returning 405 is expected: tools use POST. Check that your client sends Accept: application/json, text/event-stream and supports Streamable HTTP.