Skip to main content

​
Prerequisites

1

MCP enabled for your company

A Qobra admin controls access in Settings > AI. Before you connect, the admin must:
  1. Turn on AI for the company.
  2. Turn on the MCP agent.
The MCP agent can run for all users or as a pilot. In pilot mode, only the users in the pilot group can connect. Ask your admin to add you to the pilot if you’re not in it.If access is denied, your MCP client shows one of these messages:
2

A Qobra account

You authenticate as yourself. The tools only ever return data your Qobra user is allowed to see — the same role-based permissions as the app.

​
Server URL

The server speaks Streamable HTTP. Qobra runs it in two regions — pick the one that matches where your Qobra workspace is hosted (the same region you log in to the app from). If you’re not sure, ask the Qobra team. There is no API key. Every client authenticates through the same OAuth 2.1 flow described in Authorize below — you only ever paste the server URL, never a secret.
Everywhere below uses the EU URL as the example. If your workspace is hosted in the US, substitute https://mcp-us.qobra.co/mcp throughout.

​
Add the server to your client

Qobra is available in the Dust marketplace. Claude, ChatGPT and Gemini are just as quick to set up: add Qobra as a custom connector with the server URL.
Open Settings → Connectors → Add custom connector, give it a name (e.g. Qobra) and paste the server URL (https://mcp.qobra.co/mcp). Leave the Advanced settings (OAuth Client ID / Secret) empty.Adding the Qobra MCP server as a custom connector in Claude
The server is protected by OAuth 2.1 + PKCE — there is no API key to copy. The flow is identical for every client (Claude, ChatGPT, Gemini, Dust, n8n). On first use:
1

Discovery & registration

The client discovers the server’s OAuth metadata and registers itself automatically.
2

Consent in your browser

The client opens the Qobra consent screen in your browser. Log in to Qobra as usual (SSO / MFA included), choose Read only or Read and write, and click Authorize. See Scopes.The Qobra consent screen, with the Read only and Read and write options
3

Connected

The client receives a short-lived token and the Qobra tools appear in its toolbox. Tokens are scoped to your user and company, and can be revoked.

​
Scopes

The server has two OAuth scopes. It publishes both in scopes_supported in its protected-resource and authorization-server metadata. You choose the access level on the consent screen:
  • Read only: the token gets mcp:read.
  • Read and write: the token gets mcp:read mcp:write.
The scope your client requests only preselects this choice. Read only is preselected unless the client requested mcp:write. The token always gets the scope you picked, and the /token response returns it in scope.
  • With a read-only token, write tools don’t appear when the client lists the server’s tools. Calling a write tool anyway is refused.
  • Refreshing a token keeps the scope of the refresh token. To change the access level, reconnect the client and pick another option on the consent screen.
  • Tokens issued before the scope choice existed keep read and write access until you reconnect the client.
  • If your client asks for scopes, request mcp:read, mcp:read mcp:write, or no scope at all.
  • Do not request openid. The server doesn’t support OpenID Connect and doesn’t issue an id_token. Any scope other than mcp:read and mcp:write fails with invalid_scope.
If a client fails to connect with invalid_scope, reconnect it so it rediscovers the server’s scopes. You don’t need to recreate the credential or connector.