# MCP authorization, project selection, and discovery Look up hosted MCP authentication, eligible projects, supported clients, tool discovery, and connection revocation. Connect to `https://api.rightmessage.com/mcp/rightmessage` with hosted OAuth using the `mcp:use` scope, or with an API token in the `Authorization: Bearer` header. The connection acts for your user account; each project operation still checks project access and eligibility. For setup steps, see [Connect RightMessage to your AI assistant](https://rightmessage.com/help/connect-rightmessage-to-ai-assistants-via-mcp). ## Hosted connection | Property | Value | | ----------------------------- | ------------------------------------------------------------------------------------ | | Server URL | `https://api.rightmessage.com/mcp/rightmessage` | | Transport | Streamable HTTP. MCP messages use the hosted endpoint, not the REST `/v1` base. | | Preferred authentication | Hosted OAuth with authorization code, PKCE using `S256`, and refresh tokens. | | Required OAuth scope | `mcp:use`. | | Manual authentication | `Authorization: Bearer YOUR_API_TOKEN`. | | Request limit | 120 requests per minute. | | Protected resource metadata | `https://api.rightmessage.com/.well-known/oauth-protected-resource/mcp/rightmessage` | | Authorization server metadata | `https://api.rightmessage.com/.well-known/oauth-authorization-server` | The public discovery documents identify these OAuth endpoints. | Endpoint | Purpose | | ------------------ | ----------------------------------------------------- | | `/oauth/register` | Dynamic client registration. | | `/oauth/authorize` | Browser sign-in and approval. | | `/oauth/token` | Authorization-code exchange and refresh-token grants. | The client handles registration, PKCE, token exchange, and refresh. These aren't project-management tools, and calling a tool before authorization doesn't replace that flow. OAuth access tokens are issued for 60 minutes and refresh tokens for one year. The client should refresh access rather than ask you to create another API token. Disconnecting the client revokes its access and refresh tokens before those expiry times. Discovery metadata is limited to 120 requests per minute per IP address. Dynamic client registration is limited to 10 requests per minute and 100 per day per IP address. These are separate from the hosted MCP request limit. ## Approval and identity The consent page shows **Signed in as**, **Application**, **Redirect host**, and **Requested permission**. **Approve** authorizes the displayed application. **Cancel** denies the request. The page follows the operating system's color scheme. ![RightMessage OAuth approval for WorkForge Assistant, signed in as docs-developer@example.com, requesting mcp:use permission](https://rightmessage.com/help/screens/developers-oauth-approval.light.webp) OAuth grants permission to use MCP on your behalf. It is not a per-project or read-only grant. Project membership, account suspension, project eligibility, and feature-specific checks still apply. A bearer token authenticates the same user-level relationship. REST `read`, `write`, and `publish` abilities are not MCP permission scopes. Don't treat a REST read token as a read-only AI connection. ## Eligible projects MCP access and API-token creation are separate entitlements. MCP access comes with every plan, while creating an API token requires **Scale** or **Pro**. Hosted OAuth doesn't require creating an API token. An eligible subscription, an active entitlement, or supported legacy access can provide MCP access. A project whose 14-day trial hasn't started yet, because its billing setup didn't finish, can still be eligible for MCP. A lapsed subscription doesn't automatically retain MCP access. An expired fixed-end trial can also block project selection. Authorization has two stages. The connection requires at least one eligible project. Each project tool then checks access to the project it resolves. A successful connection doesn't mean every project or feature in the account is available. ## Supported client connections These are connection methods and accepted callback origins, not promises about a third-party subscription or menu layout. | Client | Connection method | Hosted callback origin | | -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- | | Claude Code | HTTP MCP server with browser OAuth. `claude mcp add --transport http rightmessage https://api.rightmessage.com/mcp/rightmessage`. Manual bearer header also supported. | Local callback supported. | | Claude | Custom remote MCP connector with OAuth. | `https://claude.ai` | | ChatGPT | Custom remote MCP connector with OAuth. | `https://chatgpt.com`, `https://chat.openai.com` | | Cursor | HTTP MCP server with OAuth. | `https://www.cursor.com` | | VS Code and GitHub Copilot | HTTP MCP server with OAuth. | `https://vscode.dev`, or supported loopback callback. | | Replit | Custom remote MCP connection with OAuth. | `https://replit.com` | | Lovable | Custom remote MCP connection with OAuth. | `https://lovable.app`, `https://lovable.dev` | | v0 | Custom remote MCP connection with OAuth. | `https://api.v0.dev` | | Executor | Custom remote MCP connection with OAuth. | `https://executor.sh` | | Local clients | HTTP MCP with OAuth or manual bearer header. | `http://localhost`, `http://127.0.0.1` | A callback origin must be supported even when the server URL is correct. Changing a callback to an arbitrary website isn't a substitute for compatible client support. ## Project selection Most project tools resolve a project in this order. 1. The request's explicit `project_id`. 2. The connection's remembered active project. 3. The only eligible project, if exactly one is available. 4. The user's current dashboard project, if eligible. If none resolves, the tool returns an error asking for `project_id` or `set-active-project`. A malformed ID, inaccessible project, or ineligible project returns an error rather than silently selecting a different one. Project IDs are the public IDs visible in dashboard URLs. Resource IDs, such as a flow or question ID, come from the matching list or get tool. Names aren't interchangeable with IDs. `set-active-project` remembers the choice for the connection. An explicit `project_id` overrides that default for the individual call. Selection changes which integration-dependent tools are discoverable. It doesn't change the project's configuration or restrict what projects the credential could access. There is no registered `list-projects` tool. The [configuration overview resource](https://rightmessage.com/help/mcp-prompts-and-resources) and [project context tools](https://rightmessage.com/help/mcp-tools-projects) provide the supported discovery and readback path. ## Tool discovery The public catalog contains 128 tools. A project without connected Senja exposes 126 because `list-apps` and `get-app-resources` are omitted. The server advertises `tools.listChanged`. Successful integration connection and active-project changes can notify the client to rediscover tools. A client with a cached list may need an explicit refresh or reconnection. Each registered tool supplies a name, argument schema, title, and hints about read-only, destructive, or external effects. Those hints are advisory, not an authorization boundary or a guarantee that the implementation never contacts an external service. Review the tool's arguments and documented effects before allowing it to run. The reference family pages list the actual hyphenated tool names. For example, use `get-analytics-overview`, not `get-overview`. Tools used internally by Righty aren't automatically available to external assistants. ## Drafts and other side effects Most configuration mutations change the project draft. `publish-config` is a separate operation and affects the complete publishable draft, not only the assistant's last edit. Other tools have different boundaries. Exports start jobs. Integration operations can change provider state. Feedback queues immediately. Personalized emails are saved records. Split tests have their own lifecycle. The individual tool references identify these effects. ## Connection list and revocation **Your profile** > **AI Connections** lists OAuth clients by **Client**, **Connected**, and **Expires**. Connections with a usable refresh token can remain listed after an access token expires. An unknown expiry displays **Unknown**. ![AI Connections settings explaining where authorized ChatGPT and Claude clients appear before any are connected](https://rightmessage.com/help/screens/profile-ai-connections.light.webp) **Disconnect** opens **Disconnect AI Client**. Confirming **Disconnect** revokes that user's access and refresh tokens for the client. **Cancel** leaves them active. Reconnecting requires new approval. Revocation doesn't delete projects or undo changes already made. Manual bearer tokens are managed under **API Tokens**. They aren't revoked by disconnecting an unrelated OAuth client. ## Common failures | Failure | Meaning | | ---------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | | Unauthenticated request | Missing, expired, invalid, or revoked credential. | | Missing `mcp:use` | The OAuth token lacks the required scope. | | `MCP access requires at least one eligible project.` | Connection-level eligibility failed. | | `MCP access is not enabled for this team.` | The selected project isn't eligible. | | `You do not have access to this team.` | The user isn't a member of the requested project. | | Missing or invalid `project_id` | No unambiguous valid project could be resolved. | | Unknown tool | Wrong name, stale discovery, or an integration-dependent tool isn't exposed. | | Rate limit | Too many requests within the minute. Reduce request frequency. | | Tool-specific error | Connection succeeded, but the operation failed validation, feature checks, resource lookup, or an external service request. | For a symptom-by-symptom procedure, see [Fix your AI assistant's connection to RightMessage](https://rightmessage.com/help/troubleshoot-mcp).