Connecting to the OpenX MCP Server
This page answers how a client signs in to the OpenX MCP server and what the connection is allowed to do. For step-by-step setup in a given client, see Connect a client.
The address
The server speaks Streamable HTTP. It has two addresses:
| Address | Reaches |
|---|---|
https://openx.fathym.com/ox-api/mcp/w/<workspace id> | One workspace. Sign-in skips choosing a workspace, and the connection can only ever reach that one |
https://openx.fathym.com/ox-api/mcp | All your workspaces. You pick the workspace each time you sign in |
A token is bound to the address it was made for: a token for one workspace's address is refused on the other address, and the other way round, with a bare 401 "Unauthorized". The workspace id is the ID shown in Workspace -> Settings; the window below fills it in for you. APIs -> OpenX MCP Server shows both, with Connect clients to: Just this workspace or All workspaces.
Sign in through the browser
Give the client the server URL, nothing else. The first time it connects, the server answers 401 with a
WWW-Authenticate header that points at its protected-resource metadata; the client follows it, your browser
opens, you sign in with OpenX and tick the rights to share. Clients that connect in the browser (Claude.ai,
ChatGPT and other custom connectors) find the sign-in on their own. Nothing is stored on your machine.
A sign-in gives one-hour access tokens that the client refreshes for up to 30 days, and each refresh drops any right you no longer hold.
Use an MCP key
Some clients cannot sign in through a browser, such as a CI job. Open APIs -> OpenX MCP Server, choose
Just this workspace and Paste a key, tick the rights, pick a Lifetime (1 day, 7 days or 30 days) and
click Mint an MCP key. Then put it where a setup shows <YOUR_JWT_TOKEN>. The client sends it in the
Authorization header:
Authorization: Bearer <YOUR_JWT_TOKEN>
"Copy it now: it is shown once and never kept." A key works only on one workspace's address. Your MCP keys lists your keys by id, never by value, and Revoke stops one: a revoked key's tool calls stop within five minutes, and until it expires it can still list the tools and read the prompts. A key from APIs -> API Keys is a team key for the REST API, and the MCP server does not take one.
A key replaces browser sign-in
Once a client entry carries an Authorization header, that client stops trying to sign in through
the browser. A stale or revoked key then just fails, usually as a permission error. To fix it,
remove the header from the entry, or re-install without --auth.
What a connection carries
A connection acts as you, with your own rights in the workspace, never Godmin, and only the rights you ticked. A browser sign-in is checked again at each refresh, so removing someone from the workspace cuts them off at their next refresh. An MCP key carries the rights ticked when it was minted, fixed for its lifetime.
The server takes only its own tokens. A token from an App Identity, a job token and a team API key are all refused at the door with a bare 401 "Unauthorized". What your connection may do is read on the server, never from the token; if your rights cannot be read, the connection is given none rather than guessed ones.
The workspace's API mode (Team, Hybrid or App Identity, set in the API Manager) does not apply here: the server keeps your OpenX team sign-in.
The OpenX MCP Server window
APIs -> OpenX MCP Server is open to every member; connecting is each person's own act. It has three tabs:
| Tab | What it holds |
|---|---|
| Overview | The Server URL, Connect clients to, and Connect a client: Sign in (Recommended) with set-ups for the fai CLI, Claude Desktop, Claude Code, Cursor and Browser connectors; or Paste a key (No browser), with the key form and set-ups that carry <YOUR_JWT_TOKEN> |
| Explorer | Try the server: sign in, or paste an MCP key, then Connect to see the server, its tools, prompts and resources, and run one. A tool not marked read-only asks Run it first, because it runs for real |
| Documentation | These docs, shown in the window, with Open on fathym.com |
Nothing in the window is saved to the workspace or waits for Deploy: minting and revoking a key happen at once.
Install with fai
fai mcp install registers the server with every coding agent it finds on your machine:
fai mcp install https://openx.fathym.com/ox-api/mcp --name openx
Leave out --auth to sign in through the browser.