An assistant working as you

An assistant working as you

The server speaks MCP at /mcp, so an assistant that speaks it — Claude Desktop, claude.ai, Claude Code, or any other client — can read and write your notes, tasks and projects for you, as you. It signs in the way OAuth 2.1 says a client should, which means there is nothing to configure and no token to paste:

1. Add the server's address to the assistant — in Claude Desktop and claude.ai that is Settings → Connectors → Add custom connector, with https://cm.hl.bramlabs.io/mcp as the URL; in Claude Code it is claude mcp add --transport http cloudmorrow https://…/mcp.
2. The assistant finds the sign-in page on its own and opens it in a browser: a page of this server's, which says who is asking and what it will be able to do. Sign in with your Cloudmorrow username and password and press Allow.
3. That is all. The assistant holds a token of its own from then on — good for /mcp and nothing else, and refreshed by itself for as long as it is used.

What it can do is what you can do in the app, one tool per thing: list, read, search, create, write, append to, move and delete notes; list boards and tasks, add a task, change it, move it between lanes; list, find, make and change projects. Secrets are not on the list, on purpose. A feature an administrator has switched off takes its tools off the list too.

Everything it does happens as you and lands where your other clients see it, the moment it happens. To see which assistants you have let in, and to cut one off:

curl -s $CLOUDMORROW/api/mcp/connections -H "Authorization: Bearer $TOKEN"
curl -s -X DELETE $CLOUDMORROW/api/mcp/connections/3 -H "Authorization: Bearer $TOKEN"

A cut-off assistant is back at step 2 the next time it tries.

Behind a reverse proxy, set public_url in the server config: the sign-in flow tells the assistant where its pages are, and behind a proxy the server cannot tell that address from the request it sees. Wiring a client up by hand, without the sign-in page, works too — an ordinary access token from /api/auth/login opens /mcp as well.