--- title: "Connect an assistant with MCP" description: "Connect Claude, ChatGPT, Grok or Gemini to your Sureshake reports with read-only access." --- > Documentation Index > Fetch the complete documentation index at: https://docs.sureshake.com/llms.txt > Use this file to discover all available pages before exploring further. # Connect an assistant with MCP Add Sureshake's MCP server to your assistant, sign in, and approve access. Your assistant can then find your reports and quote from them with citations. You don't need an API key, and you don't need to set up a callback URL or client secret if your assistant supports automatic OAuth setup. The server URL is: ```text https://api.sureshake.com/v2/mcp ``` ## Add the server to your assistant Your assistant account must allow custom remote MCP connections. This depends on its plan, region, version and workspace policy, and a workspace administrator may need to add the connector first. Menu names change, so if yours differ, check the provider's guide. | Assistant | Where to add Sureshake | Provider guide | | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------ | | Claude, including Claude Desktop | **Customize**, then **Connectors**, then **Add custom connector**. Enter a name and the URL, then select **Sign in now**. | [Custom connectors](https://support.claude.com/en/articles/11175166-get-started-with-custom-connectors-using-remote-mcp) | | ChatGPT | The custom MCP or app setup for your account or workspace. Enter the URL and select OAuth. Leave the client credentials empty. | [Authentication](https://developers.openai.com/plugins/build/auth) | | Grok | [Connectors](https://grok.com/connectors), then **New Connector**, then **Custom**. Enter the URL. | [Connectors](https://docs.x.ai/grok/connectors) | | Gemini web app | **Settings**, then **Connected Apps**, then **Add a custom app**. Enter the URL. | [Custom apps](https://support.google.com/gemini/answer/17209137) | For Gemini CLI, add the server, then run `/mcp auth sureshake` inside the CLI if it asks you to. The CLI needs a local browser and a free loopback port. See its [MCP server guide](https://geminicli.com/docs/tools/mcp-server/). ```sh gemini mcp add --transport http sureshake https://api.sureshake.com/v2/mcp ``` ## Approve the connection 1. **Start the connection in your assistant** Sureshake opens a page titled **Connect an assistant**. Sign in if it asks you to. 2. **Check who is asking** The page shows the application's name, its **Client** identity and a **Return to** host. The client supplies its own name, so approve only a connection you started in an assistant you trust. 3. **Select Allow report access** Then return to your assistant. Select **Cancel** instead if you didn't start this. 4. **Try it** Turn on the connector in your conversation if needed, then ask something like "Find my Sureshake reports" or "Get the evidence and citations from this report". ## What your assistant can do The connection is read-only and uses your existing report permissions. It can reach the reports you can already reach, and nothing else. | Tool | What it does | | ------------------------ | ------------------------------------------------------------------------------------------------------------------ | | `list_reports` | Lists the reports you can access, with filters and pagination | | `get_report_context` | Reads one report with its available data, citations and artifact metadata, and says which sections are unavailable | | `search_report_evidence` | Finds relevant excerpts and citations in one report | These tools return what is already in the report. They don't run a new AI analysis on Sureshake's side. Your assistant can't create, edit, publish or delete reports through this connection. ## Reconnect or disconnect Access expires after one hour, and refresh tokens aren't issued. When it expires, reconnect from your assistant. To end access sooner, open [OAuth connections](https://sureshake.com/oauth/connections) and select **Disconnect**. If you see an error, try again, because access may still be active until it succeeds or expires. ## Troubleshooting | Problem | What to do | | ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Your assistant asks for a client ID and secret | Choose automatic registration or the assistant's published identity if it offers one. If it offers neither, [register an application](#register-an-application-manually) | | Client metadata is unavailable or invalid | Start the connection again. Sureshake rejects metadata it can't verify rather than substituting another client | | Sign-in was cancelled or the approval expired | Start again from your assistant | | A report is unavailable | Check that your Sureshake account can open that report. Connecting an assistant doesn't add permissions | | You see `403` with `Origin not permitted` | The request came from a browser origin Sureshake doesn't allow. Connect through your assistant's own connector settings | An API key doesn't work on this server. It accepts only tokens from the OAuth connection above. ## Build your own MCP client Most people can stop here. If you're writing a client, these are the details it needs. | Item | Value | | ----------------------------- | ----------------------------------------------------------------------- | | Transport | Streamable HTTP at `https://api.sureshake.com/v2/mcp` | | Protected resource metadata | `https://api.sureshake.com/.well-known/oauth-protected-resource/v2/mcp` | | Authorization server metadata | `https://api.sureshake.com/.well-known/oauth-authorization-server` | | Authorization endpoint | `https://api.sureshake.com/v2/oauth/authorize` | | Token endpoint | `https://api.sureshake.com/v2/oauth/token` | | Dynamic client registration | `https://api.sureshake.com/v2/oauth/register` | | Client metadata documents | Supported, with an HTTPS URL as the client ID | | Grant type | `authorization_code`. No refresh tokens | | PKCE | `S256`, required | | Token endpoint authentication | `none`, `client_secret_post` or `client_secret_basic` | | Scope | `reports:read` | | Rate limit | 120 requests per minute | A request without a valid token gets `401` with a `WWW-Authenticate` header that points at the protected resource metadata. ### Register an application manually If your client supports neither dynamic registration nor client metadata documents: 1. Open [Settings](https://sureshake.com/settings), then the **Security** section. 2. Under **OAuth Applications**, select **New Application**. 3. Enter an **Application Name** and your client's exact callback URL under **Redirect URIs**, and select the **Read Reports** scope. 4. Select **Create Application**, then copy the client ID and secret. The secret isn't shown again. PKCE with `S256` is still required. Source: https://docs.sureshake.com/developers/mcp/index.mdx