Advanced
Agents (MCP server)
The same app said in the Model Context Protocol, so an assistant can find what you copied and put something back on the clipboard — six tools, one of which writes.
POST /mcp is the same app said in the Model Context Protocol, so that an assistant can find what you copied and put something back on the clipboard without anybody having told it this app exists. That discoverability is the whole of what it adds: everything it can do, the API could already do with a key and a curl line.
It is not a second door. Same listener, same setting, same key — a caller holding the key can already do more through /v1 than any of these tools allow, so a switch of its own would be a second thing to explain that protected nothing.
Setting it up
Switch Allow other programs to use PasteDaemon on in the Advanced pane, then copy the mcp add line beside the key. It copies with the key already in it:
claude mcp add --transport http pastedaemon \
http://127.0.0.1:28787/mcp --header "x-api-key: …"Any client that speaks streamable HTTP can be pointed at the same URL with the same header. The line goes straight to the pasteboard rather than through the clipboard monitor, for the reason the key itself does: a credential must not land in the history that the API it opens would hand back.
The six tools
| Tool | What it is for |
|---|---|
search_clipboard_history | What you copied, newest first, by substring. With no query the first result is what is on the clipboard now |
get_clipboard_entry | One entry in full, with up to five of the values it used to hold |
list_variables | The variables by name, with a short preview of each |
get_variable | One variable in full, list and all |
set_clipboard | Puts text on the clipboard. The HUD says so, as it does for the API |
pastedaemon_status | Version, whether recording is on, and how much of each thing there is |
Six rather than thirty, because a tool costs a model tokens on every turn whether or not it is used, and a wrong call is made by something that cannot read the documentation first. So the list is the smallest that covers what an assistant is actually asked for, and only one of them writes.
What it will not do
Nothing here changes a rule. Actions, triggers and abbreviations are reachable over /v1 and are not tools: they decide what happens on every future copy, a person edits them with the whole picture in front of them, and a model that added one would be changing what the app does long after the conversation that added it was forgotten. The API says it will not run anything; this says it will not quietly arrange for something to run later either.
Secrets are refused exactly as they are over /v1, by the same code — a request for one is answered as a request for a name that does not exist.
How much comes back
Every value is cut to a length worth a model's context — 800 characters in a list, 20,000 for the one thing a call was about — and anything cut says so and says how long it really was, which is what tells a model to go and ask for the whole of it.
The REST API caps a list and lets each item be whatever size it is, because what reads it has a disk; a model has a context window, and one entry holding a pasted log file would fill it. The answers are compact JSON rather than the pretty JSON /v1 returns, and for the same reason reversed: that one is read by a person in a terminal, and this one by a model paying for every token of indentation.
What it says about what it hands over
A clipboard history is the largest collection of text on the machine that nobody wrote on purpose. It is whatever you copied — off a web page, out of somebody else's document, from a chat window — so handing fifty entries to a model is handing it fifty strings somebody else may have chosen.
There is no checking that against anything, so it is said instead: the initialize instructions and every tool that returns copied text say that what comes back is data to read and report on rather than instructions to follow, however it is worded. It is the mitigation available, and it is stated in both places because a client is free to drop the instructions and a tool description travels with the call.
Worth knowing on your side of it: an assistant reading your history reads all of what it matched. If something should never be there to be read, a forget trigger is how it never gets kept, and a secret is how a value stays out of the API altogether.
The transport
Streamable HTTP with the streaming left out. A POST carries one JSON-RPC message and the answer comes back as JSON, which the specification allows for a server whose work is a lookup in memory. GET /mcp — how a client asks for a stream the server would start — is a 405 saying POST.
There is no session either: a session id exists so a server can keep state between calls, and the state that matters here is the app's and outlives every connection.
A browser is not an MCP client. Every page you have open can reach the port, so a request carrying an Origin header at all is refused — the third lock after the key and CORS, and the one the specification asks for by name. Nothing that speaks MCP sends the header.
One message at a time: a batch is refused out loud rather than answered in part. A method the server does not have is a JSON-RPC "method not found" rather than an empty list, which a client would otherwise believe in — resources/list and prompts/list land there, and should, since neither capability is declared.
The two ways a call can fail are kept apart. A client calling this server wrongly — a tool that does not exist, an argument of the wrong type — gets a JSON-RPC error, because a model cannot fix that by trying again. Something the app has to say — no entry by that id, no such variable — comes back as an ordinary result with isError set, where the model can read it and act on it.