# MCP and connected apps

> Connect AI apps through the included MCP server, OAuth consent, scoped permissions and revocable sessions.

## What ships

Slicekit serves a Model Context Protocol server at `/mcp`, using the official C# SDK and Streamable
HTTP. It includes OAuth authorization with PKCE, discovery, client registration, a browser consent
screen and **Settings, MCP & Apps** with client setup guides and editable grants.

The account tools read the current user and permissions, and update the display name or language.
<!-- user-notifications:begin -->
Notification tools list and read the personal inbox, count unread messages and mark them read or unread.
<!-- user-notifications:end -->
These are working examples for your product tools, which call the same Wolverine commands and queries
as the HTTP endpoints. Credentials, account deletion and payment actions are outside the shipped tools.

## Connect locally

MCP is enabled in the local development configuration. Run the API and SPA, then open
**Settings, MCP & Apps** to copy the server URL and follow the guide for your client.
The local URL is `http://localhost:5076/mcp`. For Claude Code:

```sh
claude mcp add --transport http slicekit http://localhost:5076/mcp
```

Open `/mcp` in Claude Code and complete browser sign-in and consent. Other compatible clients include
Claude, ChatGPT, Codex, Cursor, VS Code and Gemini CLI. Hosted clients need a publicly reachable
server; a localhost address works for clients running on your machine.

Users without an account can register during the connection flow. The pending request survives
email confirmation and sign-in and returns them to consent. Public registration must be enabled for
that path; an invite-only product still requires an [invitation](/docs/user-invitations).

## Consent and access

Users choose **Read only**, **Read and make changes** when requested by the client, or **Choose
permissions** for a custom grant. Presets include future tools within their access level; custom
grants retain the explicitly selected permissions. Each request checks the grant against the user's
current permissions and the delegable permission ceiling. Superadmin permissions cannot be delegated.

Settings lists connections separately from browser sessions. Users can edit access or disconnect;
disconnect revokes the session family and blocks already-issued access tokens. Tool calls are
audited with the client identity and outcome. Approval requires a confirmed email and, when sign-in
is no longer recent, [step-up verification](/docs/step-up-reauth).

## Enable in production

MCP is off by default in production Compose. Set `MCP_ENABLED=true` and `MCP_PUBLIC_BASE_URL` to the
public API origin in `.env.prod`. Forward `/mcp`, `/.well-known/*` and `/oauth/*` to the API as well as
`/api`. The SPA must also be reachable for sign-in and consent.

Headless clients can use `X-API-Key` only when `MCP_API_KEYS_ENABLED=true`. Use a dedicated, narrowly
scoped key with an expiry. OAuth remains the default connection method.

For tool conventions, permission coverage and configuration, read the repository's `docs/api/mcp.md`
and `docs/frontend/connect.md`. To omit this feature, scaffold with `--no-mcp` or run
`scripts/remove-mcp.sh`.

## Verify

- Connect a client, approve read-only access and confirm write tools are unavailable.
- Edit the grant, then disconnect and confirm the client loses access.
- Run `dotnet test api/fast.slnf --nologo` for tool convention and permission coverage checks.
- Run the API MCP integration tests with `dotnet test api/tests/Slicekit.Api.Tests --filter "FullyQualifiedName~Mcp"`.