MCP server

intellia mcp serves the CLI to an AI agent over the Model Context Protocol (MCP), on stdin and stdout. The agent gets the CLI’s guides, schemas, verified examples and your organization’s inventory, and can run CLI commands, with the same credentials the CLI already uses. One line of configuration adds it to Claude Code, Cursor or any other MCP client.

Add it to your client

The server has two modes. Choose one when you add it; an agent cannot change it.

Default: the agent asks before anything changes.

claude mcp add intellia -- intellia mcp

--allow-writes: the agent changes your org without asking.

claude mcp add intellia -- intellia mcp --allow-writes

--allow-writes gives the connected agent write access to your organization. Every command except secret get and secret use runs without asking you first. Use it only with an agent you would trust with your own terminal. There is no other way to turn writes on.

The same server in a project’s .mcp.json (Claude Code), or in .cursor/mcp.json or ~/.cursor/mcp.json (Cursor):

{
  "mcpServers": {
    "intellia": { "command": "intellia", "args": ["mcp"] }
  }
}

For --allow-writes, use "args": ["mcp", "--allow-writes"].

Tools

ask is billed to the active organization like intellia ask, with up to two model calls per question.

run never uses a shell: each element of the array is one argument. A leading "intellia" is dropped.

Resources

What asks first

In the default mode, run executes most read-only commands at once. These commands do not change your organization. The server’s instructions give the agent the exact list, generated from the same policy run enforces.

Every other command asks you first. It asks because the command does one or more of these things:

• changes data on the platform;
• runs code from this workspace;
• writes files on this machine;
• sends a local file to the platform.

So a read-only command still asks when:

• it runs workspace code or writes files by default, as pull, app validate and workflow build do;
• it is given an option that writes files: --output, --out, --emit, --dir, --download, --with-source, --in-place or --extract-functions;
• it sends a local file to the platform, as conditions evaluate and forms acceptance-test do.

When a command asks, your client shows a confirmation with the exact command, as it will run, and the folder it runs in. The command runs only if you approve. Each approval covers that one call. The same command asks again next time, and nothing is remembered.

Spending credits does not ask on its own. The ask tool and the read-only searches that use credits run at once. run runs ask too, and prints a hint beside the result that the ask tool is the better entry point.

The confirmation uses MCP elicitation. Support for it varies by client. A client without it cannot run anything that asks. Those commands are refused with the code mcp_confirmation_unsupported, and every command that runs at once and every other tool still works. Run the refused command in a terminal, or start the server with --allow-writes.

Never over MCP

secret get and secret use are refused in both modes, with the code mcp_command_never, even if you would approve them: either can print a credential into the agent’s context. Bind the secret to the workflow node, or use it through bindings.

Build fence

--build-fence refuses the commands a Developer Mode build does not run: each publishes, deploys or changes a resource the module declares (the user deploys the module once the build is verified), or puts a secret’s value where the run’s transcript can hold it (run refuses those two in every mode). Other live changes are not fenced. Each refusal has the code mcp_command_build_fenced and names what to run instead. The server judges the command it resolves, so an alias or an option before the command does not get around it, and --dry-run counts only as the command’s own option, never after -- or inside another argument.

The server also sets INTELLIA_BUILD_FENCE=1 for every command it runs. With that variable set to 1, the CLI itself refuses the same commands, whoever starts it: a shell, a script or another program. That refusal has the code cli_command_build_fenced. --help still works, over MCP and in the CLI.

The server in OpenCode 2.1.3’s opencode.jsonc, with Code Mode off, so each tool stays its own call:

{
  "mcp": {
    "servers": {
      "intellia": {
        "type": "local",
        "command": ["intellia", "mcp", "--allow-writes", "--build-fence"],
        "codemode": false,
        "timeout": { "execution": 330000 }
      }
    }
  }
}

OpenCode 2.1.3 has no execution timeout by default. timeout.execution is in milliseconds, and 330,000 is just over the five minutes each command has (see Limits).

The folder it starts in

Every command runs in the folder your client started the server in:

• The API endpoint and organization are resolved once, when the server starts, as the CLI resolves them in a terminal, and each command gets them as environment variables. A .intelliarc.yaml in the folder never sets them (its other keys apply); the environment and your home config can.

Inside that folder, a command does what it does in a terminal. It may write local files (for example, pull or kbs files download) and run the workspace’s own code (for example, app validate evaluates intellia.manifest.ts, and workflow build builds TypeScript workflows). MCP adds no sandbox.

Credentials

The server uses the CLI’s own credentials: INTELLIA_API_KEY or INTELLIA_TOKEN, or ~/.intellia/credentials. Credentials are redacted from results. Every tool result, resource and error is scanned, and each credential the CLI holds is replaced with <redacted>, written as-is or JSON-escaped, URL-encoded, hex or base64. A credential in another encoding, compressed or split across chunks is not recognised. Commands run with INTELLIA_AGENT_INVOCATION=1, so secret get and secret use also refuse on their own.

Limits

• Each command has five minutes. A command that does not finish is stopped, and the result says it timed out.
• A result over 200,000 characters is refused with mcp_output_too_large. The refusal still gives the command’s exit code, so you can tell whether a change went through.
• A command cannot read input. When the command has a --yes option, run adds --yes before asking you, so the confirmation shows it and your approval stands in for the command’s own prompt. Any other prompt fails at once.
• When the client closes the server, or the server gets SIGINT or SIGTERM, every running command is stopped first. A process that a command starts in a session of its own is not reached.

Errors

A refusal is the CLI’s usual error object, with ok: false, error, code and fix. explain_error (or intellia explain <code>) explains each code.