MCP integration reference
Connect software you build or manage to Undermind’s research tools. If you’re connecting an app we already support, use the setup guide.
Connection details
| Setting | Value |
|---|---|
| MCP server | https://mcp.undermind.ai/mcp |
| Transport | Streamable HTTP |
| Authorization | OAuth authorization code flow with PKCE (S256) |
| Scope | mcp |
| Client identification | Client ID Metadata Document (CIMD) or a pre-registered client ID |
| Client secret | Not required |
Undermind connections are user scoped. Every request runs as a specific Undermind user, inside that user’s workspaces, with access to their papers, searches, and saved work. Each user authorizes your application through their own Undermind account. There is no separate API-key or service-account access model for MCP, because Undermind’s tools are built around each user’s persistent research workspace rather than stateless queries.
Identify your application
Your application needs a client ID before users can authorize it. There are two ways to get one.
Client ID Metadata Document (CIMD)
Use the HTTPS URL of your publicly hosted Client ID Metadata Document as your client ID. Undermind reads it when a user connects, so no manual registration with us is required.
Pre-registered client ID
Email support@undermind.ai with:
- The application name users should see when approving access.
- The OAuth callback URLs your application uses.
We’ll register the application and send you a client ID. No client secret is needed.
The client ID identifies your application and doesn’t grant access by itself. Each user still authorizes access from their own account.
Dynamic Client Registration (DCR) is not supported. DCR is deprecated in the MCP specification in favor of CIMD.
Connect your users
Once your application is configured:
- Your application starts the OAuth authorization flow.
- The user signs into Undermind and approves access for your application.
- Your application exchanges the authorization code using PKCE and receives an access token and a refresh token.
- Your application sends MCP requests using the access token of the user it is acting for.
Users sign in through their usual Undermind sign-in method, including company SSO where configured.
MCP clients can discover the OAuth endpoints from the server. For manual configuration:
| Setting | Value |
|---|---|
| Authorization endpoint | https://api.undermind.ai/o/authorize/ |
| Token endpoint | https://api.undermind.ai/o/token/ |
| Resource indicator | https://mcp.undermind.ai/mcp |
Maintain the connection
Access tokens expire after one hour. Refresh tokens rotate on use and let your application obtain new access tokens without another browser sign-in. After authorization, your application can make requests from a backend or background job without keeping a browser open.
Connections expire after 90 days without a successful token refresh. Active connections can remain authorized through ongoing refreshes.
Users can revoke all MCP access from their Undermind account settings. Access may also be revoked for security reasons. If a connection expires or is revoked, the user needs to authorize again.
For help connecting your application, email support@undermind.ai.