Connection Details
MCP clients discover everything they need automatically. An unauthenticated request to the server
returns
401 with a WWW-Authenticate header that points to the server’s protected resource
metadata at https://mcp.chamelio.ai/.well-known/oauth-protected-resource, which in turn names
the authorization server.
Enabling MCP for Your Organization
MCP is a beta feature and is off by default. An organization admin must turn it on:1
Open Beta features
In Chamelio, go to Settings > Beta features.
2
Turn on MCP
Switch on the MCP toggle.
Authorization and Scopes
When a user connects a client, they sign in to Chamelio and approve the connection on a consent screen. Any user can connect; admin rights are not required. The server requires all of the following scopes on every token:
A token missing any of these scopes is rejected for the whole server.
Access tokens issued to MCP clients do not expire. To disconnect a client, remove the connector in
the client; see Connect Claude to Chamelio.
What the Assistant Can See and Do
Every tool runs as the signed-in user. A connected assistant sees the workflows, tasks, and documents that user can see in the web app, and anything it creates - such as a new workflow task - is attributed to that user. These tools return organization-wide information regardless of the user’s own access:list_users, list_document_types, list_org_fields, and get_document. download_file checks
only that the file belongs to your organization.
The server exposes 17 tools: 13 that only read, and 4 that create or act. Nothing in the server
approves, signs, edits, or deletes directly. See the full Tool Reference.