Model Context Protocol

Connect your AI client to your command center

The MCP server is the bridge between an AI client (Claude Code, or any MCP-capable client) and the dashboard. You sign in once, approve the connection, and the agent can read and update the work you already see.

Server endpoint

https://mcp.grafizum.com/mcp

Set it up

1

Add the server

In Claude Code, run the command below. Any MCP client: use the endpoint above as the server URL (Streamable HTTP, OAuth 2.1).

claude mcp add --transport http grafizum https://mcp.grafizum.com/mcp

https://mcp.grafizum.com/mcp

2

Approve the connection

Your client opens a one-card approval page on the dashboard. Sign in, pick the agent it should act as, and authorize. Projects and access default to the whole agent and stay editable afterwards.

3

Work

The agent can now read projects, tasks, calendar and memory — and write within its scopes. Every write it makes is recorded in the activity log.

Add a custom MCP client

Claude Code is the shortest path. Any MCP client that speaks Streamable HTTP works the same way: give it the server URL and let it run the OAuth flow itself — there is no API key to paste.

Portable format — .mcp.json, Cursor, Copilot
{
  "mcpServers": {
    "grafizum": { "type": "http", "url": "https://mcp.grafizum.com/mcp" }
  }
}

VS Code keeps the same two fields under a top-level "servers" object in .vscode/mcp.json.

Discovery

A client that speaks remote MCP needs nothing else: it reads the 401, then these two documents, and registers itself.

OAuth server metadata

https://mcp.grafizum.com/.well-known/oauth-authorization-server

Protected resource metadata

https://mcp.grafizum.com/.well-known/oauth-protected-resource/mcp

What a connection can do

Read
  • Projects, status and progress
  • Tasks and to-do lists
  • Calendar and due dates
  • Project memory and the global handbook
  • Activity summaries (never raw secret payloads)
Write
  • Create and update tasks
  • Report project status
  • Record events and calendar entries
  • Write project knowledge (within its scopes)
Never
  • Vault secrets, GitHub tokens or SSH keys
  • Projects the connection was not granted
  • Your review decisions

Manage connections

Every connection appears in the dashboard under MCP, named after the agent it acts as. Rename it, narrow it to fewer projects, drop write access, or revoke it — changes apply to the next request, with no need to reconnect. A connection lasts 30 days before it must be approved again; its access tokens last 15 minutes and refresh on their own.

Open the MCP tab

How it is kept safe

  • OAuth 2.1 authorization code with PKCE. Tokens are stored hashed, access tokens last 15 minutes, and refresh tokens rotate — a reused one revokes the whole connection.
  • A connection is a ceiling, never a widening: it can never carry more scopes or projects than the acting agent already has, and vault, GitHub and delete scopes are never available.
  • Registration and authorization are rate-limited, and every write is checked against the connection's scopes and project list before it is accepted.
  • Approving shows the exact address the authorization code is sent to, so a familiar-sounding client name cannot hide where your access is going.

Troubleshooting

The client says MCP login required (401)

The token expired or the connection was revoked. Re-run the client's authentication — approving it again takes one click.

The approval page says the request expired

A pending authorization is valid for 10 minutes and can be used once. Start authentication again from the client.

A tool call is refused

The connection may lack that scope or project. Check the MCP tab, then narrow or widen the connection there.

Open the MCP tabSecurity