Connect an AI assistant to your app's data

Your app can let your own customers — or your own team — connect an AI assistant such as Claude Desktop, Claude Code, ChatGPT, or any other Model Context Protocol (MCP)-compatible client directly to their own data in your app. The assistant can only see and change what the connection key you hand it is allowed to touch — nothing more.

This is different from this app's existing Connect MCP device-approval flow above it on the same page, which is a developer/automation tool for connecting things like Cursor to the platform's own admin APIs. The AI Assistant connector described here is for an end customer of one of your applications connecting a personal AI client to that one application's own runtime data.

Console: TenancyEngine console → API keys (/api-keys) → AI Assistant / MCP Connector

Before you start

You'll create an API key scoped to exactly one application, carrying the mcp.connect scope. A key like this is a credential, same as a password — anyone holding it can act as your connected AI client for that one application, limited to whatever scopes you grant it. Treat it accordingly:

• Bind the key to one application. An AI-assistant connector key should almost never be org-wide — pick the specific application in the form below.
• Grant only the scopes the assistant actually needs. mcp.connect alone unlocks the connection itself; some of your app's tools may additionally require a narrower domain scope (for example a hypothetical sites.write for a site-builder app) — your app's own MCP tool documentation tells you which. Don't add scopes "just in case."
• Only hand the key to a client you trust. Once pasted into Claude Desktop's config file, a ChatGPT connector setup, or anywhere else, that client can use the key for as long as it's valid.
• The plain key is shown once. Copy it into your AI client's configuration immediately — the console never displays it again. If you lose it, revoke the key and create a new one.

Create a connector key

1. Open API keys and select the organization.
2. In AI Assistant / MCP Connector, choose the application the assistant should connect to.
3. Optionally add any extra scopes your app's tools require, beyond mcp.connect.
4. Click Create connector key. The plain key appears once, along with ready-to-copy setup snippets for the clients below.

Set up each client

Claude Code (CLI)

Run the command shown in the console — it uses Claude Code's built-in remote-MCP support:

claude mcp add --transport http <a-name-you-choose> <gateway-url> \
  --header "Authorization: Bearer <your-api-key>"

Claude Desktop

Claude Desktop's claude_desktop_config.json file only launches local MCP servers directly. To reach a remote, key-authenticated server like this one, add an entry that runs the mcp-remote bridge (Node.js required) — the snippet the console generates for you looks like:

{
  "mcpServers": {
    "<a-name-you-choose>": {
      "command": "npx",
      "args": ["mcp-remote", "<gateway-url>", "--header", "Authorization:${TE_MCP_TOKEN}"],
      "env": { "TE_MCP_TOKEN": "Bearer <your-api-key>" }
    }
  }
}

Add this to your config file (macOS: ~/Library/Application Support/Claude/claude_desktop_config.json; Windows: %APPDATA%\Claude\claude_desktop_config.json), then restart Claude Desktop.

Claude Desktop and claude.ai also offer a built-in Custom Connectors UI (Settings → Connectors → Add custom connector, paste the gateway URL) — today that path expects OAuth, which this gateway doesn't implement yet, so the mcp-remote snippet above is the reliable option for now.

ChatGPT and any other MCP-compatible client

Not every client has a named preset. Use the raw connection details directly:

URL	shown in the console (Streamable HTTP, JSON-RPC 2.0 — no SSE)
Header	Authorization: Bearer <your-api-key>

What "no tools" means

If your connected client shows the connection succeeding but lists no tools, the most common cause is a missing scope — the key has mcp.connect (required just to open the connection) but not the extra domain scope a specific tool requires. Check your app's MCP tool documentation for which scopes it needs, then create a new key with that scope added (existing keys can't be edited after creation — revoke and reissue).

Revoke access

Open API keys, find the connector key in the list (shown by name and key prefix, never the full value), and click Revoke. The AI client immediately loses access on its next call.

Related

• SDK reference - the MCP gateway alongside every server/mobile/browser SDK

• API keys — the general API key management screen this connector lives inside

• Team — human members vs. automation/connector keys