Support
One hosted endpoint (https://zephex.dev/mcp) gives every developer the same 10 MCP tools — without syncing local MCP configs across laptops. Use this page as your internal rollout policy and security-review packet.
Every developer maintains a different local MCP stack. Onboarding means Slack threads and broken configs.
With Zephex: Share one quickstart snippet. Track usage per key in the dashboard. Rotate keys without changing the endpoint.
Compare hosted vs local MCP and vs filesystem MCP before infra/legal sign-off.
curl -fsSL https://zephex.dev/install.sh | bashcd your-monoreponpx zephex setup# Create named keys in dashboard → API Keys:# cursor-dev-alice, ci-staging, prod-api-01# Point every editor at https://zephex.dev/mcpFull walkthrough: Quickstart · Slash palette: 116 slash commands · CLI without agent: Mode 2
API keys are stored as HMAC-SHA256 hashes with a per-key salt — never in plaintext. Keys expire after 365 days by default; create shorter-lived keys for contractors. See key naming and API key management.
| Rule | Detail |
|---|---|
| One key per person per environment | Example: cursor-dev-alice, ci-staging, prod-api-01. Never post keys in Slack, email, or public repos. |
| Rotate on offboarding | When a contractor or employee leaves, revoke every key they had access to in the dashboard — do not rotate the whole team unless compromised. |
| CI uses dedicated keys | Separate keys for automation; prefer Pro/Max tool scopes so CI cannot call tools it does not need. |
| Store secrets in a vault | Local .env for dev; Doppler, AWS Secrets Manager, or your CI secret store for staging/prod — never commit keys. |
| Name keys for analytics | Readable names make dashboard usage attribution obvious when debugging quota or abuse. |
On Pro and Max: unlimited keys and optional per-key tool scopes — calls outside the allowlist are rejected.
Each successful MCP tool call = one request on the account monthly budget. Monitor in the dashboard before engineers see HTTP 429.
| Tier | Price | Requests | Backends | Support |
|---|---|---|---|---|
| Free | $0/mo | 555/mo | 3 | Community |
| Pro | $7/mo | 3,500/mo | 10 | |
| Max | $19/mo | 10,000/mo | 20 | Priority |
Need more than 10,000 requests/month or custom rate limits? support@zephex.dev
Every editor shares the same tool surface. Users may disable up to six tools but must keep at least four enabled. Per-tool guides: Tools index.
| MCP tool | Name | Category | ~Credits | When teams use it |
|---|---|---|---|---|
| get_project_context | Project Context | Context | ~7 | First on a new repo before guessing install/test commands. Follow related_topics for deeper slices. |
| read_code | Code Reader | Code Analysis | ~5 | Known symbol or files[] from find_code. Outline before 300+ line files. Scan/smell on 3–8 focus files. |
| find_code | Code Search | Code Analysis | ~5 | Unknown location; pasted line; rename before editing; multi-keyword topic hunt. |
| explain_architecture | Architecture Analyzer | Architecture | ~7 | Before cross-cutting edits — how does this feature/subsystem span modules? |
| Zephex_dev_info | Zephex Dev Info | External | ~2 | Generic playbook after repo tools if local context is insufficient. |
| audit_headers | Site Audit | External | ~6 | User pastes live URL — post-deploy, security, framework, secrets, is it up. |
| check_test | Test Pulse | Verification | ~5 | After code changes, before push, or when user asks if tests pass — not to find which files to edit. |
| check_package | Package Check | Package Intelligence | ~5 | Before npm/pip/cargo install or version bump. User asks "is X safe?" or "how do I upgrade X?" |
| keep_thinking | Keep Thinking | Thinking | ~5 | High-blast-radius edit (auth, billing, schema); debugging after 2+ failed attempts; task spans 3+ files. |
| project_memory | Project Memory | Context | ~5 | User says remember/recall; before unfamiliar subsystem; after non-obvious decision. |
Pick one transport per editor class (stdio for Cursor/Claude Code, HTTP for VS Code). Publish internal snippets from supported editors — 27 documented — so onboarding is copy-paste, not Slack threads.
npx -y zephex@latest in editor MCP config — use mcpcli repair when tools/list goes empty.mcpcli — see CLI commands.Zephex does not train on customer source, prompts, or tool outputs. Code is processed in memory for the request lifecycle only. Share these pages with legal/infra:
What we store vs. not
| Data | Stored? | Duration |
|---|---|---|
| Source code in tool calls | No | — |
| Tool input arguments | No | — |
| Tool output / response body | No | — |
| AI chat / prompts | No | — |
| Tool name per call | Yes | 90 days |
| Timestamp + success/error + latency | Yes | 90 days |
| API key hash (HMAC-SHA256 + salt) | Yes | Until revoked |
| Hashed IP address | Yes | 90 days |
If an API key is exposed:
# Day-one onboarding/overview → /architecture → /find "auth" → /test # Dependency PR/deps → /safe new-package → /upgrade stripe → /test → /failures # Production URL gate/web staging.example.com → /check-url https://staging.example.com --deep # Cross-session conventions/remember "webhooks use raw body on /api/stripe"/recall stripeOrganizational use is governed by our Terms of Service and Privacy Policy. Team-specific account responsibilities are in the Terms section "Team and organizational use."