Connection Details
MCP clients discover everything they need automatically. An unauthenticated request to the server
returns
401 with a WWW-Authenticate header that points to the server’s protected resource
metadata at https://mcp.chamelio.ai/.well-known/oauth-protected-resource, which in turn names
the authorization server.
Enabling MCP for Your Organization
MCP is a beta feature and is off by default. An organization admin must turn it on:1
Open Beta features
In Chamelio, go to Settings > Beta features.
2
Turn on MCP
Switch on the MCP toggle.
If you don’t see the MCP toggle, MCP has not been made available to your organization yet.
Contact your Chamelio account team.
Authorization and Scopes
When a user connects a client, they sign in to Chamelio and approve the connection on a consent screen. Any user can connect; admin rights are not required. The server requires all of the following scopes on every token:
A token missing any of these scopes is rejected for the whole server.
Access tokens issued to MCP clients do not expire. To disconnect a client, remove the connector in
the client; see Connect Claude to Chamelio.
What the Assistant Can See and Do
Every tool runs as the signed-in user. A connected assistant sees the workflows, tasks, and documents that user can see in the web app, and anything it creates - such as a new workflow task - is attributed to that user. These tools return organization-wide information regardless of the user’s own access:list_users, list_document_types, list_org_fields, and get_document. download_file checks
only that the file belongs to your organization.
The server exposes 17 tools: 13 that only read, and 4 that create or act. Nothing in the server
approves, signs, edits, or deletes directly. See the full Tool Reference.