MCP server
Connect an AI agent to the Workwae MCP server with an API key or OAuth, and pick which clients and scopes to use.
Workwae runs a Model Context Protocol server that lets AI agents read and write the mail, calendars and contacts of connected accounts. This page shows how to connect a client; the pages that follow cover the tools, sending, and serving your own users.
Overview
| Property | Value |
|---|---|
| URL | https://api.workwae.com/mcp |
| Transport | Streamable HTTP, stateless |
| Protocol versions | 2026-07-28, 2025-11-25, 2025-06-18 |
| Authentication | An API key, an MCP key, or OAuth |
- Tools go through the same API as
/v1: scopes, plan limits, rate limits and metering apply as they do there. - Every tool call, reads included, is recorded in the audit log under the surface MCP.
- Besides tools, the server serves prompts (slash commands), MCP Apps views (
io.modelcontextprotocol/ui) and, on 2026-07-28, MCP Events.
Pick how the client authenticates by who uses it:
| Who | Credential |
|---|---|
| Your backend or a headless agent | An API key |
| A person with a console login, in Claude, ChatGPT or an IDE | OAuth |
| Your own users, who have no console login | An MCP key per account |
| A coding agent building your integration | An API key on the developer toolset |
Connect with an API key
Send the key as a bearer token. The client sees only the tools the key's scopes allow.
- Give an agent
readandwritewithoutsendto let it draft replies but never send them. - Limit the key to the accounts it needs under API keys, Accounts. See Authentication and API keys.
- Account tokens (
wat_...) are refused.
claude mcp add --transport http workwae https://api.workwae.com/mcp \
--header "Authorization: Bearer $WORKWAE_API_KEY"Connect with OAuth
Clients that support MCP authorization need only the URL: Claude and ChatGPT connectors, and Claude Code, Cursor and VS Code without a header. The user signs in to the Workwae console and decides what the client may do.
The client finds the authorization server
It reads https://api.workwae.com/.well-known/oauth-protected-resource/mcp.
The client identifies itself
With a client ID metadata document (Claude, Claude Code, ChatGPT and VS Code publish one, so they connect without registering), or through dynamic client registration. Registration allows 10 registrations per 10 minutes from one address, then answers 429 with Retry-After.
The user consents in the console
Every client asks for consent the first time. The user picks:
- The workspace the client acts in. Picking one does not switch the console to it.
- The scopes, out of
read,writeandsend, capped by the user's role there (a viewer can grant onlyread).adminis never granted over OAuth. - All accounts, including ones connected later, or specific accounts.
Tokens and revocation
- Access tokens last 15 minutes and are refreshed with
offline_access. - Each request is checked against the grant and the user's current role. Removing the user from the workspace, lowering their role or revoking the grant takes effect at once.
- A tool or prompt that needs a scope the grant lacks, but the user's role allows, answers 403
insufficient_scopenaming every scope needed. The client asks the user to sign in again with them. - Users revoke their grants under Account, Connected apps. Owners and admins revoke any member's under Settings, Connected apps.
- A client that registered itself and was never consented to is deleted after 7 days; registering again is all it takes.
MCP for your users
Your users have no console login, so they cannot use OAuth. Mint each one an MCP key bound to their connected account; it works only on this server. See MCP for your users.
Discovery
- Server cards at
https://api.workwae.com/mcp/server-cardandhttps://api.workwae.com/mcp/developer/server-cardgive identity, transport, authentication and protocol versions, readable without a token. - An AI catalog at
https://api.workwae.com/.well-known/ai-catalog.jsonlinks both. - The MCP Registry lists the server as
com.workwae/mcp.