MCP Server
What is MCP?
The Model Context Protocol (MCP) is an open standard developed by Anthropic that allows AI assistants like Claude to securely connect to external tools and data sources. Instead of embedding credentials or writing custom API calls, you expose a set of tools that Claude can call on your behalf.
MCP servers can run locally on your machine (communicating over stdio) or remotely over HTTPS using the Streamable HTTP transport. Clavis supports both modes — the same four tools are available either way.
Two Ways to Connect
| Remote endpoint | Local stdio (npm) | |
|---|---|---|
| URL / command | https://clavisagent.com/mcp |
npx @clavisagent/mcp-server |
| Transport | Streamable HTTP | stdio |
| Authentication | OAuth 2.1 (authorization-code + PKCE) | Static JWT in config file |
| Install required | None | Node.js 18+ and npm |
| Best for | Claude.ai and any Streamable HTTP MCP client | Claude Desktop (local development) |
Remote Endpoint (OAuth 2.1)
No install. Authenticate once with OAuth 2.1 and connect from any Streamable HTTP MCP client.
The remote MCP endpoint is a Streamable HTTP server hosted at:
https://clavisagent.com/mcp
It is protected by OAuth 2.1 using the authorization-code flow with PKCE. MCP clients that support OAuth 2.1 discovery handle the login flow automatically — they read the server metadata and redirect you to authorize. You do not manually paste tokens.
OAuth 2.1 discovery
The server publishes standard discovery documents that compliant clients use automatically:
GET https://clavisagent.com/.well-known/oauth-authorization-server
GET https://clavisagent.com/.well-known/oauth-protected-resource
Any MCP client that implements OAuth 2.1 discovery per the MCP specification will find and use these automatically. No manual configuration of token or authorize endpoints is needed.
Connecting a client
For clients that support remote MCP connections with OAuth 2.1 (such as Claude.ai):
- In your MCP client settings, add a new remote server.
- Enter the URL:
https://clavisagent.com/mcp - Your client will redirect you to Clavis to authorize — log in with your Clavis account.
- After authorizing, the client holds an access token and can call all four tools immediately.
Manual / programmatic access
If you are building a custom agent or script that calls the MCP endpoint directly, authenticate the same way as the REST API — obtain a JWT from POST /v1/auth/login and pass it as a Bearer token:
TOKEN=$(curl -sX POST https://clavisagent.com/v1/auth/login \
-H 'Content-Type: application/json' \
-d '{"email":"you@example.com","password":"yourpassword"}' \
| python3 -c "import sys,json; print(json.load(sys.stdin)['access_token'])")
curl -X POST https://clavisagent.com/mcp \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
Local stdio Package (Claude Desktop)
Install once via npm. Best for local development with Claude Desktop.
The local path runs the MCP server as a child process on your machine via npx. Claude Desktop launches it and communicates over stdio. Your Clavis JWT goes in the config file rather than through an OAuth flow.
Requirements
No separate install step is required — Claude Desktop fetches and runs the latest version via npx automatically.
Configuration
Add the Clavis MCP server to your Claude Desktop configuration file. The file location depends on your OS:
- macOS:
~/Library/Application Support/Claude/claude_desktop_config.json - Windows:
%APPDATA%\Claude\claude_desktop_config.json - Linux:
~/.config/Claude/claude_desktop_config.json
Add the following entry to the mcpServers section. If the file does not exist yet, create it with this structure:
{
"mcpServers": {
"clavis": {
"command": "npx",
"args": ["-y", "@clavisagent/mcp-server"],
"env": {
"CLAVIS_API_KEY": "eyJ...", // JWT from POST /v1/auth/login
"CLAVIS_API_URL": "https://clavisagent.com"
}
}
}
}
POST /v1/auth/login to receive a JWT (starts with eyJ). Use that JWT — not the cla_… key shown at sign-up — as your CLAVIS_API_KEY.
After saving the config, restart Claude Desktop. You should see a hammer icon in the chat input bar indicating MCP tools are available.
Troubleshooting (local)
Claude Desktop does not show the Clavis tools
Fully quit and restart Claude Desktop after editing the config. Verify the JSON is valid (no trailing commas):
$ node -e "JSON.parse(require('fs').readFileSync(process.argv[1],'utf8')) && console.log('valid JSON')" \
~/Library/Application\ Support/Claude/claude_desktop_config.json
Authentication errors
If Claude reports authentication failures, your JWT may have expired (default TTL is 24 hours). Fetch a fresh token and update the config:
$ curl -sX POST https://clavisagent.com/v1/auth/login \
-H 'Content-Type: application/json' \
-d '{"email":"you@example.com","password":"yourpassword"}' \
| python3 -m json.tool
npx fails or times out
Verify Node.js 18+ is installed and your network can reach the npm registry. You can also pre-cache the package:
$ npm install -g @clavisagent/mcp-server
Then update the config to "command": "clavis-mcp", "args": [] instead of using npx.
Available Tools
The same four tools are available regardless of which connection mode you use:
| Tool | Description | Parameters |
|---|---|---|
| list_services | Returns all services registered in your Clavis account — name, connector type, and auth method. | None |
| get_credentials | Retrieves a valid, decrypted access token for the named service. Handles token refresh automatically if the cached token is expired. | service_name (string) — the name you gave the service when registering it (e.g., "my-openai") |
| check_credential_status | Checks whether a service's credentials are valid and returns rate-limit status (remaining requests, reset time). | service_name (string) |
| call_service Recommended | Makes an API call with server-side credential injection. The credential is fetched from the Clavis vault and injected into the upstream request — Claude never sees the raw key. Prevents prompt-injection exfiltration architecturally. | service_name, method, url (required); headers, params, json, data (optional) |
call_service instead of get_credentials wherever possible.
call_service injects the credential server-side — it never appears in the conversation,
eliminating prompt-injection exfiltration as an attack vector.
Example Usage
Once connected (via either mode), you can interact with your Clavis credentials using plain English:
list_services]You have 3 services registered:
•
my-openai — openai connector (api_key)•
my-github — github connector (oauth2)•
stripe-prod — stripe connector (api_key)call_service with service_name: "stripe-prod", method: "GET", url: "https://api.stripe.com/v1/balance"]Your Stripe balance:
• Available: $4,231.00 USD
• Pending: $182.50 USD
The API key was injected server-side — it was never part of this conversation.
check_credential_status with service_name: "stripe-prod"]Your
stripe-prod service looks healthy:• Status: valid
• Requests remaining: 847 / 1000 this window
• Window resets in: 34 minutes
NPM Package
The local stdio package is published on npm. Inspect the source, report issues, and track releases on the package page: