> ## Documentation Index
> Fetch the complete documentation index at: https://docs.chamelio.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP Server (beta)

> Connect AI assistants such as Claude to Chamelio through the Model Context Protocol (MCP).

Chamelio runs a remote [Model Context Protocol](https://modelcontextprotocol.io) server. Any MCP
client that supports remote servers with OAuth - such as Claude - can connect to it and use
Chamelio's workflows, tasks, documents, and agent on behalf of the signed-in user.

For step-by-step setup in Claude, see [Connect Claude to Chamelio](/guides/integrations/claude-mcp).

## Connection Details

| Setting              | Value                                                                                                          |
| -------------------- | -------------------------------------------------------------------------------------------------------------- |
| Server URL           | `https://mcp.chamelio.ai/mcp`                                                                                  |
| Transport            | Streamable HTTP. SSE and stdio transports are not offered                                                      |
| Authentication       | OAuth 2.1 authorization code flow with PKCE (`S256`)                                                           |
| Authorization server | `https://platform.chamelio.ai`                                                                                 |
| Client registration  | Automatic. MCP clients register themselves; you do not need to create an OAuth application or copy a client ID |

MCP clients discover everything they need automatically. An unauthenticated request to the server
returns `401` with a `WWW-Authenticate` header that points to the server's protected resource
metadata at `https://mcp.chamelio.ai/.well-known/oauth-protected-resource`, which in turn names
the authorization server.

## Enabling MCP for Your Organization

MCP is a beta feature and is off by default. An organization admin must turn it on:

<Steps>
  <Step title="Open Beta features">
    In [Chamelio](https://app.chamelio.ai), go to **Settings > Beta features**.
  </Step>

  <Step title="Turn on MCP">
    Switch on the **MCP** toggle.
  </Step>
</Steps>

<Note>
  If you don't see the **MCP** toggle, MCP has not been made available to your organization yet.
  Contact your Chamelio account team.
</Note>

While MCP is off, clients can still connect and sign in, but every tool call fails with:

```text theme={null}
MCP is not enabled for this organization
```

## Authorization and Scopes

When a user connects a client, they sign in to Chamelio and approve the connection on a consent
screen. Any user can connect; admin rights are not required. The server requires all of the
following scopes on every token:

| Scope             | Grants                                                         |
| ----------------- | -------------------------------------------------------------- |
| `workflows:read`  | List and read workflows and their status                       |
| `workflows:write` | Initiate and act on workflows                                  |
| `tasks:read`      | Read tasks                                                     |
| `files:read`      | Download files                                                 |
| `users:read`      | Read organization users and groups                             |
| `sor:read`        | Read system-of-record objects                                  |
| `agent:write`     | Ask the Chamelio agent questions and let it act on your behalf |

A token missing any of these scopes is rejected for the whole server.

Access tokens issued to MCP clients do not expire. To disconnect a client, remove the connector in
the client; see [Connect Claude to Chamelio](/guides/integrations/claude-mcp#disconnect).

## What the Assistant Can See and Do

Every tool runs **as the signed-in user**. A connected assistant sees the workflows, tasks, and
documents that user can see in the web app, and anything it creates - such as a new workflow task -
is attributed to that user.

These tools return organization-wide information regardless of the user's own access:
`list_users`, `list_document_types`, `list_org_fields`, and `get_document`. `download_file` checks
only that the file belongs to your organization.

The server exposes 17 tools: 13 that only read, and 4 that create or act. Nothing in the server
approves, signs, edits, or deletes directly. See the full [Tool Reference](/api-reference/mcp/tools).

## Errors

Tool errors come back to the assistant as text. Two are final and should not be retried:

| Message                                   | Meaning                                                          |
| ----------------------------------------- | ---------------------------------------------------------------- |
| `You do not have access to this resource` | The signed-in user cannot reach this workflow, task, or document |
| `Not found`                               | The ID does not exist in your organization                       |