MCP has moved from developer tooling into everyday apps. Two very different companies now offer hosted MCP servers: Framer (websites) and Mercury (business banking). Taken together, they show where agent permissions are heading. MCP drew about 7,300 posts in our X sample this week.
New to MCP? Start with MCP explained for vibe coders.
Framer MCP: your agent can build your site
Server URL: https://mcp.framer.com/mcp
Framer says its MCP lets you "design, build, and update your site" from AI tools you already use. There are one-click installs for ChatGPT, Codex, Claude, Claude Code and Cursor, and install guides for OpenCode, VS Code, Windsurf, Warp, Antigravity and more. Any tool that supports remote MCP servers with OAuth can connect.
What the agent can access, per Framer's FAQ: the canvas, components, supported project settings and CMS in projects your Framer account has access to. It uses your account's permissions.
What makes it workable:
- No local bridge. You don't need the Framer editor open, and you can work from desktop, browser or phone.
- Changes don't go live by default. They stay in your project or branch until someone publishes.
- Branches. Framer suggests asking your agent to work on a branch, so you can compare with main before publishing.
- Your AI costs follow your agent's plan, not Framer's built-in agent.
What to watch: the agent can publish if you explicitly ask it to. Keep "publish" as a step you do yourself.
Framer MCP is now the recommended way to connect agents. The older @framer/agent CLI still works for some workflows, such as localization.
Connecting from Claude Code (remote HTTP server):
claude mcp add --transport http framer https://mcp.framer.com/mcp
Then approve the connection with your Framer account when prompted. For Cursor, Codex and others, see our guide to adding an MCP server.
Mercury MCP: your agent can see, and request, money moves
Mercury's MCP is a hosted server that connects tools like ChatGPT and Claude to your Mercury account through OAuth. It's in beta, and Mercury warns: "Double check any responses from the LLM with your Mercury account for any important decisions."
What an agent can do:
| Action | What happens |
|---|---|
| Query transactions, balances, statements, cards, recipients | Read access |
| Request a payment to an existing recipient | Creates a request. You approve it in Mercury. |
| Request an internal transfer | Same: request only, approved in Mercury |
| Create or edit expense categories, update notes and categories | Applies immediately |
The key line from Mercury's docs: your AI tool "cannot approve the request or move money on its own." Your organization's approval policies still apply. Even if a policy would normally allow the action without approval, the requester has to approve it in Mercury. And a created request does not mean money was sent.
Write actions need explicit permissions. If you already have a read-only connection, it doesn't gain write access automatically. You have to reauthorize and review the write permissions on Mercury's consent screen.
The pattern worth copying
Both servers follow the same design:
- OAuth with scoped permissions. No pasted API keys.
- Agent drafts, human ships. Framer keeps changes off the live site; Mercury makes the agent request and a human approve.
- Low-risk edits flow freely. Notes, categories and draft pages can go straight through.
Use that checklist for any MCP server you connect, and for any you build. Our MCP security best practices cover the rest: prompt injection, over-broad scopes and untrusted servers.
Should you connect them?
- Framer: worth it if you already build in Framer and use Claude Code, Cursor or Codex. Start on a branch.
- Mercury: reading spend data is low risk and useful. Turn on write permissions only once you're comfortable, and remember category edits apply instantly.
For a wider look at agent safety settings, see running coding agents safely.
