> ## Documentation Index > Fetch the complete documentation index at: https://docs.stackone.com/llms.txt > Use this file to discover all available pages before exploring further. # StackOne MCP Server > Connect chat apps, coding agents and automation platforms to StackOne over MCP with one URL, and let each user choose the accounts and actions it can reach. The StackOne MCP server turns the [actions](https://docs.stackone.com/gateway/concepts/actions.md) on your [Linked Accounts](https://docs.stackone.com/connect/managing-connectors/linking-accounts.md) into tools that any client supporting the Model Context Protocol (MCP) can call. ## The server URL Everyone uses the same URL in their client: ``` https://mcp.stackone.com/mcp ``` The URL grants no access by itself, so you can publish it in an internal wiki or helpdesk article. Each person who adds it signs in to StackOne and chooses which of their Linked Accounts the client can reach. The client receives tools, and provider credentials stay in StackOne. > [!NOTE] > > Most clients open a sign-in prompt as soon as the server is added, and some wait until the first tool call. See [Client setup (OAuth)](#client-setup-oauth) for popular clients. ## What the user sees Authorization happens in the StackOne dashboard, against the user's own login. Sign in, pick a [project](https://docs.stackone.com/gateway/concepts/organizations-and-projects.md), select the [Linked Accounts](https://docs.stackone.com/connect/managing-connectors/linking-accounts.md) the client should reach, then **Authorize**. The granted accounts and actions become the client's tool list. Selecting an account grants every [action](https://docs.stackone.com/gateway/concepts/actions.md) enabled on its [Connector Profile](https://docs.stackone.com/connect/managing-connectors/connector-profiles.md). Expanding an account narrows the grant to individual actions. The same screen carries the **Load tools when needed** toggle, which puts the connection into [Advanced Tool Search](https://docs.stackone.com/optimize/advanced-tool-search.md). It is on by default. Under the client's logo, the screen shows where the connection returns after you approve, such as **Returns to claude.ai**. For a client that publishes its own details, such as Claude Code or VS Code, it also shows the domain it came from. Check that both match the client you are connecting. Any program on your device can catch a sign-in that returns to localhost or to an app on it, so only continue if you started the connection yourself, from that client. ![StackOne authorization screen listing organizations, with a project selected inside one of them](https://mintcdn.com/stackone-60/RgaE_4ZxFuvAQ6gS/images/ai-platforms/oauth-consent-select-project.png?fit=max\&auto=format\&n=RgaE_4ZxFuvAQ6gS\&q=85\&s=69d4694c8ea854c52ec62fc1bbe0825a) Pick a project ![StackOne authorization screen showing two linked accounts, Linear and Open-Meteo, both selected, above the Load tools when needed toggle](https://mintcdn.com/stackone-60/RgaE_4ZxFuvAQ6gS/images/ai-platforms/oauth-consent-select-accounts.png?fit=max\&auto=format\&n=RgaE_4ZxFuvAQ6gS\&q=85\&s=66ef4eb4d8bf6e5246e5f01ec959c187) Select accounts ![An expanded linked account showing individual actions with toggles, descriptions, and category tags](https://mintcdn.com/stackone-60/RgaE_4ZxFuvAQ6gS/images/ai-platforms/oauth-consent-select-actions.png?fit=max\&auto=format\&n=RgaE_4ZxFuvAQ6gS\&q=85\&s=c86b615e0f55cd43236e38142c1ebca5) Narrow the actions Each client guide under [Client setup (OAuth)](#client-setup-oauth) walks through every screen. To send your team step-by-step instructions, point them to their AI platform's user setup page (Organization User Setup). See [AI Platforms](https://docs.stackone.com/ai-platforms/overview.md) for the list. ## Who can grant access Users typically hold the [**Project Member** role](https://docs.stackone.com/secure/identity-and-access/roles-and-groups/project-roles.md), which is what the flow is built around. A Project Member sees the accounts they linked themselves, plus any they have been added to. That is what makes one URL safe to publish across an organization. Access can also be granted on a single Linked Account, which is how a shared account (a service mailbox, a company CRM login) reaches someone who is otherwise only a Project Member. Each person added to an account gets one of two levels: | On a Linked Account | Can | | - | - | | **Account Admin** | Run actions, edit, delete, re-authenticate, and manage who else has access | | **Account Member** | Run actions only | ## Choosing a connection method | | [OAuth](#client-setup-oauth) | [Token apps](#client-setup-token-apps) | | - | - | - | | Best for | A person using a client interactively | Clients that do not support OAuth, or unattended use (such as a shared server or a scheduled workflow) | | Who gets access | The person who signed in and approved | Anyone holding the URL | | Accounts covered | Several, chosen at approval time | Up to 50, chosen at creation time | | Ends when | The grant is revoked under Connected Apps | The token expires, is revoked under Connected Apps, or the URL is regenerated | | Safe to circulate | Yes | No, treat it as a password | ## Client setup (OAuth) OAuth is the recommended way to connect. Each person authorizes with their own StackOne login, and their grant can be revoked at any time. ### Popular clients Each AI platform with a StackOne guide is listed on [AI Platforms](https://docs.stackone.com/ai-platforms/overview.md), with its setup pages. These clients connect too, following their own docs: | Client | Setup | Their docs | | - | - | - | | Azure AI Foundry | URL only | [MCP tool](https://learn.microsoft.com/en-us/azure/ai-foundry/agents/how-to/tools/model-context-protocol) | | Postman | Detects OAuth on its own and offers an **Authorize** button | [MCP requests](https://learning.postman.com/docs/postman-ai-agent-builder/mcp-requests/overview/) | | LangChain | Through the MCP adapters package | [langchain-mcp-adapters](https://github.com/langchain-ai/langchain-mcp-adapters) | ### Clients requiring Client ID and Secret Most clients identify themselves to StackOne automatically, which is why the URL is usually the whole configuration. Claude Code and VS Code publish their details at an address StackOne reads, and other clients, including Cursor, register on first connect. A few sign in from a fixed, hosted callback address instead and cannot self-register. Those need a client created in the dashboard first, and you paste its credentials into the client. **1. Create the client** Go to **Project Settings → MCP OAuth Clients → Create OAuth Client**. Give it a descriptive name, leave **Client type** set to `Confidential`, and add one **redirect URI** per line. This is the callback address the client returns to after sign-in, which the client's own documentation states. The **Common integrations** picker fills the redirect URI in for the clients we have confirmed: | Preset | Redirect URI | | - | - | | Gemini Enterprise | `https://vertexaisearch.cloud.google.com/oauth-redirect` | | Microsoft 365 Copilot | `https://teams.microsoft.com/api/platform/v1.0/oAuthRedirect` | | Claude | `https://claude.ai/api/mcp/auth_callback` | | Cursor | `https://www.cursor.com/agents/mcp/oauth/callback` | Redirect URIs must be `https` or a loopback address. **2. Copy the credentials** **Generate** returns the client ID and secret. The secret is shown only once, so store it before you close the panel. If it is lost, create a new client rather than trying to recover it. **3. Configure the client** Paste the credentials into the client along with the endpoints shown beside them: | Field | Value | | - | - | | MCP server URL | `https://mcp.stackone.com/mcp` | | Authorization endpoint | `https://idp-api.stackone.com/api/auth/oauth2/authorize` | | Token endpoint | `https://idp-api.stackone.com/api/auth/oauth2/token` | | Scopes | `mcp offline_access` | Then run the flow. The consent screen is the same one every other client shows, and [Who can grant access](#who-can-grant-access) applies unchanged. Clients that currently need this: | Client | Their docs | | - | - | | Gemini Enterprise | [Assistant actions](https://docs.cloud.google.com/gemini/enterprise/docs/assistant-actions) | | Microsoft 365 Copilot | [MCP actions](https://learn.microsoft.com/en-us/microsoft-copilot-studio/agent-extend-action-mcp), [authenticating it](https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/plugin-authentication) | | Google ADK | [MCP tools](https://google.github.io/adk-docs/tools/mcp-tools/) | > [!NOTE] > > Access tokens last one hour and are renewed automatically using the `offline_access` refresh token. The grant itself lasts 90 days, after which the user runs the flow again. Revoking under **Connected Apps** ends it immediately. ### Connect another MCP client Any MCP client that speaks the Streamable HTTP transport and supports OAuth can connect. Point it at `https://mcp.stackone.com/mcp` and let it run the flow. If a client cannot open a browser for someone to approve the prompt or does not support OAuth, create a [token app](#client-setup-token-apps) instead. ### Reviewing and revoking access Every authorization is a grant against the user who approved it, not against a project API key. Users manage their own grants under **Connected Apps → OAuth apps** in the dashboard. **Edit tool access** changes which accounts and actions a grant covers without running the flow again, though a client that keeps its own tool list needs reconnecting or refreshing to show the change. Revoking a grant immediately stops that client's tool calls. **Project Admins** and **Organization Admins** see every grant in the project and can edit or revoke them. Revoking access does not unlink the account or change the Connector Profile. The account keeps working for every other client. ## Client setup (token apps) Token apps connect MCP clients that do not support OAuth, such as background jobs, scheduled scripts, or headless agents. Each app receives a URL carrying its own token: ``` https://api.stackone.com/mcp?token={token} ``` Point your MCP client to this URL as the server address. ### Create a token app **Project Admins** and **Project Members** can create token apps. **1. Open the create panel** Go to **Connected Apps → Token apps** and click **Create token app**. **2. Configure the app** Set the following: * **Name**: a descriptive name for the client, for example `Claude Desktop`. * **Acts as**: `You` to run calls under your own permissions and runtime policies, or `The project` to run calls on behalf of the project. Only **Project Admins** can choose `The project`. * **Expires after**: the token lifetime (`1 day`, `7 days`, `30 days`, or `1 year`). * **Accounts and tools**: select up to 50 [Linked Accounts](https://docs.stackone.com/connect/managing-connectors/linking-accounts.md). Selecting an account grants all enabled [actions](https://docs.stackone.com/gateway/concepts/actions.md); expand an account to choose specific actions. **3. Copy the MCP URL** Click **Create**, then copy the **MCP URL**. > [!WARNING] > > Anyone holding the URL can make tool calls with the access granted to the app. Treat the URL like a password. The token is shown only once: if lost, you must **regenerate the URL**, which invalidates the previous URL. ### Manage token apps Manage existing token apps under **Connected Apps → Token apps**: * **Edit accounts and tools**: select a token app from the list to open its details panel. The creator (for an app acting as You) or a Project Admin (for an app acting as The project) can update the selected accounts and actions, then click **Save changes**. The URL remains unchanged. * **Regenerate URL**: in the row menu or details panel, click **Regenerate URL** and select an expiry to issue a new token. This immediately invalidates the previous URL. * **Revoke**: in the row menu or details panel, click **Revoke** to delete the token app and permanently deactivate its URL. Project Admins can revoke any token app in the project; Project Members can revoke apps they created. Everything above is for clients your users run themselves, each signing in with their own StackOne login. To call the MCP server from your own product instead, with your API key and an account ID per end-user, see [MCP](https://docs.stackone.com/embed/call-actions/mcp) in the Embed tab. ## Optimize and secure With your agent connected, use StackOne's platform features to optimize performance and secure every call. > [card] [Advanced Tool Search](https://docs.stackone.com/optimize/advanced-tool-search.md) > > Reduce context and save tokens. > [card] [Deep Query](https://docs.stackone.com/optimize/deep-query.md) > > Search synced records for a fraction of the tokens. > [card] [Defender](https://docs.stackone.com/secure/defender.md) > > Block prompt injections before they reach your agent. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.