Provider REST API
AIConnect Claude to Replicate
Find a model on Replicate, run it, and poll the prediction until the output is ready. Toolspoke puts 11 of its actions behind one MCP endpoint that Claude, Cursor, and Codex all speak.
- Connection
- Provider REST API
- Authentication
- API token
- Actions exposed
- 11
- Cost per call (typical)
- 1 credit
- Adapter
- Maintained by Toolspoke
Connected in three steps
- 1
Install Replicate
Open the marketplace in your workspace, add Replicate to the project your agents work in, and it appears on the gateway immediately.
- 2
Connect the credential
Authenticate with api token. Where to get one, and what it has to be able to reach, is the next section.
- 3
Point your agent at the gateway
Give your client one address, https://toolspoke.com/mcp. Claude Code takes it as a command, Claude and Claude Desktop add it as a custom connector, and Cursor, Codex and VS Code each read it from a config file of their own.
.mcp.json{
"mcpServers": {
"toolspoke": {
"type": "http",
"url": "https://toolspoke.com/mcp"
}
}
}One block covers every tool you have installed. Replicate shows up in the client as soon as your policy allows it, and so does everything else you install later.
Where the address goes, per client
- Claude Code
Run it in your project, then /mcp to sign in
claude mcp add --transport http toolspoke https://toolspoke.com/mcp- Claude and Claude Desktop
Settings, then Connectors, then Add custom connector
https://toolspoke.com/mcp- Cursor
~/.cursor/mcp.json, or .cursor/mcp.json for one project
{ "mcpServers": { "toolspoke": { "url": "https://toolspoke.com/mcp" } } }- Codex
~/.codex/config.toml
[mcp_servers.toolspoke] url = "https://toolspoke.com/mcp"- VS Code
.vscode/mcp.json, or the MCP: Add Server command
{ "servers": { "toolspoke": { "type": "http", "url": "https://toolspoke.com/mcp" } } }
What Replicate asks for
API token. You provide it once, when you install the connector. Toolspoke encrypts it at rest and decrypts it only for the length of a single call, and the gateway attaches it to the outbound request itself, so it is never part of the arguments an agent sends.
- API tokenRequired
- replicate.com → Account settings → API tokens. Sent as `Authorization: Bearer r8_…`, which is the scheme Replicate's OpenAPI document declares - paste only the token, not the word Token or Bearer.
- r8_…
What Claude can do in Replicate
11 actions, each one declared and named by the connector rather than discovered at runtime. A workspace policy grants a person all of them, a hand-picked selection, everything on the read side, everything on the write side, or none.
- Reads
- 9Reads
- Writes
- 2Writes
- Destructive
- 0Destructive
Reads
9Fetches data and changes nothing.
get_accountRead the account this token belongs to: `username`, `type` (user or organization), display name and avatar. Free - it runs no model and starts no prediction. Use it to confirm which account is about to be billed before running anything, and note that it returns no balance or spend figure, because Replicate exposes none through the API. This is the connection test for exactly those reasons: it costs nothing, creates nothing and needs no arguments.
list_modelsBrowse Replicate's public models, newest version first by default. Free. The answer is trimmed to the fields worth reading - owner, name, description, visibility, run count and URL - because the untrimmed record for every model carries a full `openapi_schema` and a page of them is tens of thousands of tokens an agent will not read. Call get_model once you have a candidate; that is where the input schema lives. There is no text search here: Replicate serves search as an HTTP `QUERY` request this connector cannot express, so narrow by browsing list_collections instead, or pass an `owner/name` you already know straight to get_model. Paging is Replicate's own: the raw response carries a `next` URL rather than a cursor parameter, and this connector has no way to follow it.
get_modelRead one model by owner and name. Free. This is the call worth making before create_prediction: the response carries `latest_version`, and inside it `openapi_schema`, which is the authoritative list of what that model's `input` object accepts and requires. Every model on Replicate declares its own parameters and rejects parameters belonging to another, so guessing from a similar model is how a prediction fails. `default_example` shows a real call that worked. Take `latest_version.id` from here to pin a version, or pass `owner/name` alone to create_prediction to use whatever is newest.
list_model_versionsList the published versions of one model, newest first. Free. A version id is a 64-character hash and it is what pins a prediction to code that will not change under it - the model's owner can push a new version at any time, and a prediction that named only `owner/name` runs the new one. Read the ids here, then read one with get_model_version to see the input schema that version declares.
get_model_versionRead one pinned version of a model, including the `openapi_schema` describing exactly what `input` that version accepts. Free. Use it when a prediction has to be reproducible: the schema a model declares changes between versions, so a body built against the newest version can be rejected by an older one and vice versa. Pass the same version id to create_prediction.
list_collectionsList Replicate's curated model collections - "text-to-image", "super-resolution" and the rest - with their slugs and descriptions. Free. This is the practical way to find a model on this connector, because the text search Replicate offers is an HTTP `QUERY` request that cannot be declared here. Pick a slug and read it with get_collection.
get_collectionRead one curated collection and the models in it. Free. Each entry carries owner, name, description and run count, trimmed the same way list_models is trimmed, so use get_model afterwards for the input schema of whichever one looks right. `run_count` is the most useful signal in here: a model nobody runs is usually a model that no longer works.
get_predictionCheck a prediction started by create_prediction and read its result. Free - polling is not billed; the compute already running is. `status` is starting, processing, succeeded, failed, canceled or aborted, and the last four are terminal. Poll about every two seconds at first and back off towards ten. A succeeded prediction carries `output`, whose shape is the model's own: a string, a URL, a list of URLs, or an object. `metrics.predict_time` is the number the per-second bill is computed from. Output file URLs are deleted an hour after the prediction was created, so download anything worth keeping rather than storing the URL. `logs` carries the model's own stderr, which is where a failure usually explains itself.
list_predictionsList predictions made by this account, newest first. Free. This is how to find a submission whose id was lost - a create_prediction call that timed out ambiguously should be looked for here rather than repeated, because Replicate accepts no idempotency key and a repeat is a second charge. Narrow with created_after and created_before; there is no way to page further, because Replicate returns a `next` URL rather than a cursor parameter and this connector cannot follow it. Every record carries the `input` it was given and the `output` it produced, which is why the payload is kept out of the audit log.
Writes
2Creates or updates something on the other side.
create_predictionRun a model. This is the operation that costs money, and it is the only one here that does: Replicate bills either per second of the hardware the model runs on - from about $0.000025 a second on a small CPU to about $0.0122 a second on eight H100s - or per output for many image, video and language models, where a single image is commonly $0.025 to $0.09 and a second of video $0.09 to $0.25. Read the model's page for which of the two it uses before running anything in a loop. Nothing but an id and `status: starting` comes back: poll get_prediction until the status is terminal, then read `output`. `version` accepts three forms - "owner/name" for an official model, "owner/name:versionid", or a bare 64-character version id - and pinning a version is what stops the model changing under you. `input` must match the model's own schema exactly, which get_model returns as `openapi_schema`; a parameter belonging to a different model is rejected rather than ignored. Output files are deleted after one hour, so copy anything worth keeping. Submissions take no idempotency key, so a call that times out ambiguously must not be blindly repeated - look for it with list_predictions instead. Webhooks are not offered here on purpose; polling is.
cancel_predictionStop a prediction that is still starting or processing, so it stops costing money. Free to call. A prediction that has already reached a terminal status is unaffected. This destroys nothing recoverable: a canceled prediction has produced no output to lose, and the record of it stays readable through get_prediction. Note that cancelling an official model may still be charged for the compute already used, so it limits a runaway rather than refunding one. The response is the prediction record, which carries the input it was given.
What it will not do
Enforced by the gateway rather than left to convention, which is why each of these can be stated flatly.
- It cannot call anything else
- The 11 actions above are the whole of it. A call to any other name is refused before it reaches Replicate rather than forwarded on, and connecting your account does not add to the list: it is fixed by the connector, not discovered at run time.
- Nothing here deletes
- This connector writes to Replicate, but nothing in it deletes or permanently alters anything.
- It reaches no further than your credential
- Toolspoke holds no access to Replicate of its own. Every call carries the credential you stored and nothing besides, so whatever that credential cannot reach, this connector cannot reach either.
- It never hears from Replicate
- Nothing is pushed to it. There is no webhook, no subscription and no polling, so this connector cannot notice by itself that something changed in Replicate. An agent has to ask.
- It does not smooth over provider limits
- Toolspoke does not retry, queue or back off around Replicate's own rate limits. A call that Replicate refuses comes back to the agent as a failed call.
Before you connect it
What can Claude do in Replicate?
11 named actions: 9 that only read and 2 that write. They include get_account, list_models and get_model. Nothing outside that list is reachable: the connector declares each operation by name rather than proxying whatever an agent asks for.
What credentials does the Replicate connector need?
API token. The connector asks for api token. Values are encrypted at rest and attached to the outbound request by the gateway, so they are never part of the arguments an agent sends and never reach the audit log.
Does the Replicate connector work with Cursor and Codex, or only Claude?
Any client that speaks MCP, and every one of them gets the same 11 actions. There is a single address, https://toolspoke.com/mcp. Claude Code adds it with claude mcp add --transport http, Claude and Claude Desktop take it as a custom connector in settings, Cursor reads it from .cursor/mcp.json, Codex from ~/.codex/config.toml, and VS Code from .vscode/mcp.json. Each of them signs in to the gateway itself, so there is no key to paste.
What does the Replicate connector not do?
The 11 actions above are the whole of it. A call to any other name is refused before it reaches Replicate rather than forwarded on, and connecting your account does not add to the list: it is fixed by the connector, not discovered at run time. This connector writes to Replicate, but nothing in it deletes or permanently alters anything. Toolspoke holds no access to Replicate of its own. Every call carries the credential you stored and nothing besides, so whatever that credential cannot reach, this connector cannot reach either. Nothing is pushed to it. There is no webhook, no subscription and no polling, so this connector cannot notice by itself that something changed in Replicate. An agent has to ask. Toolspoke does not retry, queue or back off around Replicate's own rate limits. A call that Replicate refuses comes back to the agent as a failed call.
Can I limit which actions an agent can call?
Yes, in two places. The project switches Replicate's actions on and off one at a time, for everyone in the project at once, and the screen groups them by read, write and destructive so turning off everything that deletes is one click. An individual agent key can then be narrowed further, to particular toolkits in a project and to particular actions in a toolkit. Whatever it was granted, a key never reaches a project its owner cannot.
What gets recorded when an agent calls Replicate?
Every attempt, with the agent that made it and the person that agent belongs to, the full request payload, the response payload, the status, the duration, and the credits spent. Values whose key names a secret are masked out before the record is shown to anyone. An operation the connector marks as not retained never has its response body written at all, so the gateway keeps no second copy of what was read.