Skip to main content
Version: Next

Connect to GRIFFai over MCP

The canonical remote endpoint is:

https://mcp.griff.run/mcp

It uses MCP Streamable HTTP. Interactive clients discover OAuth automatically from the endpoint's WWW-Authenticate challenge and well-known metadata. Authorization is tenant-scoped, PKCE uses S256, access tokens are resource-bound, refresh and revocation are supported, and the tool catalog is filtered by the workspace's current entitlements.

connect.griff.run is accepted only for validating pre-migration credentials through 2026-11-09T00:00:00Z. Configure every new or updated client with the canonical mcp.griff.run endpoint above.

Interactive clients​

For ChatGPT custom connectors, Claude Desktop, Claude Code, VS Code, Cursor, Windsurf, Cloudflare Agents, and MCP Inspector, add a remote HTTP server with the canonical URL. If the client has separate URL and transport fields, choose Streamable HTTP. Complete the browser authorization screen with your workspace slug and one-time workspace access key.

Do not add bearer tokens to the URL. Clients should store OAuth credentials in their native credential store.

Headless service accounts​

Request a short-lived access token with OAuth client credentials:

POST https://mcp.griff.run/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&
client_id=WORKSPACE_SLUG&
client_secret=WORKSPACE_ACCESS_KEY&
scope=tenant%3Aread%20brain%3Aproxy&
resource=https%3A%2F%2Fmcp.griff.run%2Fmcp

The response deliberately has no refresh token. Request a new access token when it expires. Rotate the workspace key from the control plane if it is exposed.

Restricted free lane​

Free accounts can authorize with a griffai_user_… access key. The lane exposes only tenant_info, brain_recall, and brain_remember; memory writes remain disabled until email verification, and monthly quota reservations fail closed.

Discovery and automation​

Expected negative responses​

  • Missing/invalid bearer on /mcp: HTTP 401 with a resource-metadata challenge.
  • Unknown scope: invalid_scope.
  • Wrong resource: invalid_target.
  • Invalid workspace credentials: invalid_client.
  • Revoked token: invalid_token or invalid_grant.
  • Suspended tenant or unavailable metering reservation: request fails closed.