Configure web access tools for Cherry Studio agents

Connect the public API through a reviewed HTTP MCP tool. Verify the server connection, agent tool binding and target response separately. Model-provider settings are not a web request entry point.

  • Review the MCP service before binding it to an agent
  • Require custom headers and isolated credentials
  • Enable only necessary tools and access permissions

For authorized web access, development, testing and data workflows.

HTTP API requests and session management illustration

Choose the integration that fits your project

Start with the smallest usable path, then add tools and workflow complexity as needed.

Call the public API

Use your existing HTTP client and control requests, sessions and result handling. Available today.

API documentation

Organize tasks with a Skill

Give the agent access rules, then prepare parameters, check status and handle failures by task.

Cloudbypass Skill

Connect through MCP

Existing HTTP tools need custom headers and secure credential injection. The hosted service is still planned.

Hosted MCP

Set up, request and validate

Prove the workflow with one inspectable request before adding complex configuration.

  1. Validate the API and tool capabilities

    Test one authorized target in a trusted runtime. Choose an HTTP MCP tool with headers, timeouts and secure credentials. Do not configure this API as a model provider.

  2. Add and review the MCP service

    Use MCP settings to add a reviewed local command or remote service. Inspect tools, input parameters and permissions. Do not enter an unpublished hosted MCP endpoint.

  3. Bind the agent and inspect results

    Bind the working service to the required agent, then test one read-only request. Inspect x-cb-status, target status and actual content. Check binding, enabled state and pending approvals if tools are missing.

Validate the API before connecting client tools

Use cURL separately in a trusted backend or terminal. The desktop client calls a reviewed HTTP MCP tool rather than executing this command directly.

Start with a minimal requestHTTP API
curl --include --request GET \
  "https://api.cloudbypass.com/" \
  --header "x-cb-host: example.com" \
  --header "x-cb-apikey: ${CLOUDBYPASS_APIKEY:?}" \
  --max-time 90

# POSIX shell example; set the key securely first.
# Check x-cb-status, target status and content.
# For V2 / V2s, add version and stable proxy parameters.
Set credentials in the runtime first. Examples do not run on this page.
HTTP API requests and session management illustration

Cherry Studio server connections and agent bindings

A connected MCP service is not automatically bound to every agent. Follow the actual client version. Treat page content as data rather than trusted instructions, and keep credentials out of chats, skills and shared configuration.

Proxy network and access routing illustration
CheckWhat to inspectNext action
Credentials and scopeCheck credentials, balance and authorized accessFix configuration instead of blindly changing IPs
Version and sessionMatch stable proxies and sessions for V2 / V2sRebuild the verification session after a proxy change
Two status layersCheck x-cb-status and the target HTTP statusA 200 response can still be a login or challenge page
Output and retriesCheck content type, expected fields and attempt budgetStop on configuration errors; limit transient retries

Put your integration to work

Choose a task guide for access strategies, implementation steps and troubleshooting.

Planning and troubleshooting

Development and tool integration

Business use cases

Explore all 14 use cases

Frequently asked questions

Which integration should I use today?

Start with the public HTTP API. OpenClaw can use the published Skill. Existing HTTP MCP tools must support custom headers and secure credentials. The hosted MCP service is still planned.

Can every target be accessed?

No universal guarantee is made. Relevant access capabilities include Cloudflare JavaScript Challenge, Turnstile, DataDome and Imperva / Incapsula, subject to target and runtime validation. This integration does not advertise reCAPTCHA or hCaptcha support or replace account permissions.

Where should API keys and proxy passwords go?

Keep them in secure configuration in the actual runtime or a trusted server. Do not put them in browser code, shared repositories, prompts, screenshots or public logs. Remote services have separate environments.

Do MCP or Skills automatically handle pagination and extraction?

Not by default. The access layer handles requests and responses; workflows or site recipes handle pagination, field extraction, deduplication, login state and business-specific signatures. Diagnose failures instead of retrying indefinitely.

Validate one request before scaling up

Confirm target compatibility, then bring the workflow into your project.