Every client below connects to the same endpoint. What changes is where you put the URL, and which of the two credentials you use.

The quickest path is in the app: Settings → Your assistant at app.attensira.com/settings/access. Pick the assistant you use (Claude, ChatGPT, Cursor, Claude Code, Codex or VS Code) and you get that one’s steps, ready to copy, with nothing else to read through. Claude and ChatGPT connect only by signing in, so they are listed only while sign-in is available. This page has the same steps plus every other client.

Setting	Value
Server URL	`https://mcp.attensira.com/mcp`
Transport	Streamable HTTP
Authentication	OAuth (sign in through the browser) or `Authorization: Bearer atn_live_<your key>`

Which credential to use

Both work, on the same endpoint, and neither is going away.

	OAuth	Static API key
Use it for	Interactive clients with a human and a browser — Claude, Claude Code, Cursor, VS Code, ChatGPT	Headless callers — n8n, CI jobs, scripts, servers
Setup	Paste the URL and sign in	Mint a key, paste it into a header
Secret on disk	None. The client stores a token it can refresh	Yes. A long-lived key sits in a config file or a secret store
Expiry	Access tokens are short-lived and refresh silently; you sign in again occasionally	Never expires until you revoke it
Taking it away	Remove the server in the client	Revoke it in Settings → Your assistant, effective on the next request

If a human is going to be sitting there when the client first starts, use OAuth: there is no key to paste, nothing to leak into a committed config file, and revoking one client does not break the others. If nothing can open a browser, use a key.

You can do both at once. Claude Code on your laptop over OAuth and an n8n workflow on a static key are two independent credentials against the same server, and revoking either leaves the other alone.

Which clients need a bridge

The Attensira server speaks Streamable HTTP only. Clients that speak remote HTTP natively connect directly. Clients that only launch local stdio processes cannot, and need the mcp-remote bridge, which runs locally over stdio and forwards to the HTTPS endpoint.

Client	Connects directly	OAuth	Notes
Claude Code, Claude Desktop, Claude.ai	Yes	Yes	Native remote HTTP and OAuth
Cursor, VS Code + Copilot	Yes	Yes	Browser prompt on first connect
ChatGPT	Yes	Yes	Connector configured in the UI
Windsurf, Cline	Yes	Varies by build	Config file takes a `url` and `headers`; use a key if the build has no OAuth
Codex CLI	Yes	No	`codex mcp add --bearer-token-env-var` keeps the key out of config
n8n	Yes	No	Headless — use a static key
Zed	Yes	Yes	Remote server with a `url`; Zed runs OAuth when there is no `Authorization` header
Older client builds that launch local processes only	Via `mcp-remote`	Yes, through the bridge	stdio-only; see the bridge section

Connecting with OAuth

Nothing to mint and nothing to paste. You add the URL, a browser opens, you sign in and choose a workspace, and the client stores a token it refreshes on its own.

Claude.ai and Claude Desktop

Go to Settings → Connectors → Add custom connector, name it Attensira, and enter:

Server URL

https://mcp.attensira.com/mcp

Leave every authentication field alone — do not add a header, and do not paste a client ID or secret. Choose Connect, and Claude sends you to Attensira to sign in. Approve the access it asks for, and you land back in Claude with the connector enabled. The connection reaches every workspace your organisation owns; you name one in the conversation when there are several. You do not need a workspace first. Once you are signed in, ask Claude to set one up for your domain, and it walks you through it — see Set up a business from your assistant. Open a new chat and enable Attensira from the tools menu. Existing conversations do not pick up new connectors. The connector works in claude.ai, Claude Desktop and the Claude mobile apps.

Availability of custom connectors depends on your Claude plan. On Team and Enterprise, an owner adds the connector first, under Organization settings → Connectors.

Claude Code

Add the server with no credential at all, then authenticate from inside Claude Code:

Shell

claude mcp add --transport http attensira https://mcp.attensira.com/mcp

Then run /mcp, select attensira, and choose to authenticate. A browser opens, you sign in and approve, and the callback returns to a local port Claude Code is listening on. Add --scope user to make the server available in every project rather than only the current one. Verify with claude mcp list, then ask Claude to call get_account — a successful reply lists the workspaces the credential can reach.

Two Claude Code instances can authenticate at the same time. Each listens on its own ephemeral loopback port, and both are accepted.

Cursor

Add to Cursor — one-click install link. Cursor must already be installed; clicking it opens Cursor and prompts you to add the server. It writes the URL and nothing else — no key, and nothing is read or transmitted. You can also add it by hand. Create .cursor/mcp.json in the project, or ~/.cursor/mcp.json for all projects. With OAuth there is no secret in the file, so the in-repo path is safe:

.cursor/mcp.json

{
  "mcpServers": {
    "attensira": {
      "url": "https://mcp.attensira.com/mcp"
    }
  }
}

Reload Cursor and open Settings → MCP. The entry shows as needing authentication; click through it, sign in and approve, and the tools fill in.

VS Code + Copilot

VS Code reads .mcp.json at the workspace root or .vscode/mcp.json. With OAuth the whole file is three lines and carries nothing secret:

.vscode/mcp.json

{
  "servers": {
    "attensira": {
      "type": "http",
      "url": "https://mcp.attensira.com/mcp"
    }
  }
}

Start the server from the Start link above the entry. VS Code opens a browser for sign-in and stores the resulting token in its own account storage, not in the file. Then open Copilot Chat in Agent mode and check the tools picker.

ChatGPT

Turn on developer mode

In ChatGPT on the web, open Settings and turn on Developer mode.

Create the app

Create an app, name it Attensira, enter https://mcp.attensira.com/mcp and choose OAuth. Attensira publishes standard OAuth discovery, so there is no client ID or secret to fill in.

Turn it on in a chat

In a chat, open the + menu, choose Developer mode and turn Attensira on.

Developer mode depends on your ChatGPT plan and, on Business and Enterprise, on what an admin allows. Custom MCP connectors in ChatGPT depend on your plan and workspace settings, and some surfaces restrict which tools a connector may call. If write tools such as add_prompts are unavailable, that is a ChatGPT-side restriction, not a scope problem — check Connections to see what you actually granted before assuming otherwise.

Zed

Current Zed builds connect to remote MCP servers directly. In Settings → AI → MCP Servers, choose Add Server → Add Remote Server, or add the entry to your settings file yourself:

Zed settings.json

{
  "context_servers": {
    "attensira": {
      "url": "https://mcp.attensira.com/mcp"
    }
  }
}

With no Authorization header, Zed runs the standard MCP OAuth flow itself: it opens a browser, you sign in and approve, and the tools appear in the Agent Panel. To use a key instead, add "headers": { "Authorization": "Bearer atn_live_..." } to the same entry. The indicator next to the server in Settings → AI → MCP Servers turns green when it is active.

Older builds and stdio-only clients

A client, or an older Zed build, that can only launch local processes needs the mcp-remote bridge. The bridge runs locally over stdio, forwards to the HTTPS endpoint, runs the OAuth flow itself and caches the token under your home directory:

Zed settings.json (older builds)

{
  "context_servers": {
    "attensira": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://mcp.attensira.com/mcp"]
    }
  }
}

The bridge needs Node.js. Its first run downloads the package and opens a browser, so allow a few seconds and expect a sign-in prompt before the tools appear.

What you are approving

The consent screen names the application and the access it wants. Read both. An OAuth connection always carries read and write: there is no read-only consent. Write covers everything that changes the workspace or spends credits — adding prompts, creating and running automations, deleting things, asking the agents, approving or declining what they propose. A client that can only read cannot do the half of the job you connected it for. Where you need a credential that cannot write, mint a read-only API key instead.

Anyone can register an MCP client and pick its display name. Read the name before approving, and be sure about anything unfamiliar. If you did not just start a connection yourself, do not approve one — close the tab.

What an approved client can reach, and how to disconnect one, is in Connected applications.

Connecting with a static key

This is the path for anything without a human and a browser: n8n, CI, a scheduled script, a server-side agent. It is fully supported and is not going anywhere.

Get a key first

Mint a key under Settings → Your assistant at app.attensira.com/settings/access. It is shown exactly once: only a hash is stored, so Attensira cannot re-display it. Copy it somewhere safe — a password manager or your shell environment — before you close the dialog. The key names your workspace, so no tool asks for a workspace id. If you lose it, revoke and mint a new one; there is no recovery path.

Export it once and reference it by name wherever a client supports environment variables:

Shell

export ATTENSIRA_API_KEY="atn_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Put that line in your shell profile so GUI clients launched from a terminal inherit it.

.cursor/mcp.json, .vscode/mcp.json, and any config file inside a repository are shared files. A key pasted into one and committed is a leaked key — assume it is public the moment it is pushed, revoke it, and mint a new one. Use the environment-variable form in repo-visible files, add local overrides to .gitignore, or use OAuth, which puts no secret in the file at all.

n8n

Use the MCP Client Tool node inside an AI Agent workflow. Set the endpoint to https://mcp.attensira.com/mcp and the transport to HTTP Streamable — not SSE, which the server does not offer. For credentials, choose the Bearer or header-auth credential type and store the key there. n8n credentials are encrypted at rest and are not written into the workflow JSON, so an exported or version-controlled workflow does not carry the key. Once connected, the node exposes the Attensira tools to the agent; restrict the tool list on the node if you do not want the agent reaching credit-spending tools such as run_automation. This is exactly the case OAuth cannot serve: a workflow fires at 3am with nobody to approve a browser prompt. Use a key, give it the narrowest scope the workflow needs, and name it after the workflow so revoking it later is unambiguous.

Codex CLI

Codex reads the token from a named environment variable at runtime and sends it as the Authorization header itself, so the key never enters ~/.codex/config.toml:

Shell

codex mcp add attensira --url https://mcp.attensira.com/mcp \
  --bearer-token-env-var ATTENSIRA_API_KEY

That writes an mcp_servers.attensira table to ~/.codex/config.toml without the key. Make sure ATTENSIRA_API_KEY is set in the shell profile Codex launches from. Only if your Codex build does not support --bearer-token-env-var, edit ~/.codex/config.toml directly with the key written literally:

~/.codex/config.toml

[mcp_servers.attensira]
url = "https://mcp.attensira.com/mcp"

[mcp_servers.attensira.http_headers]
Authorization = "Bearer atn_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Restart Codex after editing the file.

Windsurf

Windsurf reads ~/.codeium/windsurf/mcp_config.json:

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "attensira": {
      "serverUrl": "https://mcp.attensira.com/mcp",
      "headers": {
        "Authorization": "Bearer atn_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
      }
    }
  }
}

If your Windsurf version rejects serverUrl, use "url" instead — the two spellings have both shipped. Press the refresh control in the Cascade MCP panel after saving. Since this file lives in your home directory, it is not part of any repository, but it is still plaintext on disk.

Cline

In VS Code, open Cline → MCP Servers → Configure, and add a remote entry:

cline_mcp_settings.json

{
  "mcpServers": {
    "attensira": {
      "type": "streamableHttp",
      "url": "https://mcp.attensira.com/mcp",
      "headers": {
        "Authorization": "Bearer atn_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
      }
    }
  }
}

Cline also has a “Remote Servers” tab where you can paste the URL and header without editing JSON. If your Cline version offers only stdio entries, use the mcp-remote command shown below.

Claude Desktop and Claude Code with a key

Both support OAuth, and OAuth is the better path on a machine with a browser. Use a key only where you deliberately want a fixed credential — a shared build machine, or a container without an interactive session.

Claude Code

claude mcp add --transport http attensira https://mcp.attensira.com/mcp \
  --header "Authorization: Bearer $ATTENSIRA_API_KEY"

Claude Desktop does not expand shell variables in claude_desktop_config.json, so the key is written literally — protect the file with filesystem permissions and never copy it into a repository:

claude_desktop_config.json

{
  "mcpServers": {
    "attensira": {
      "url": "https://mcp.attensira.com/mcp",
      "headers": {
        "Authorization": "Bearer atn_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
      }
    }
  }
}

Restart the app afterwards. The Attensira tools appear in the tool menu of a new conversation; existing conversations do not pick up new servers.

Marked via your assistant

Anything your assistant files in your workspace (an Inbox row, a change to approve, a question) is marked with the client it came through, such as via Claude or via Cursor. The Inbox gathers those rows under From your assistant, and an approval or decline your assistant makes is recorded in the item’s history the same way, for example “OAuth connection via Claude”. You can tell at a glance which items you asked your assistant for and which the agents raised. The name comes from the client itself. When a client connects to the MCP server it says what it is, and the server passes that name on. Attensira shows it only when it is one it recognises:

Shown as	For
via Claude, via Claude Code	Claude (claude.ai, Desktop, mobile) and Claude Code
via ChatGPT	ChatGPT
via Cursor, via Codex, via VS Code	Those clients
via n8n	n8n, which counts as API use rather than as an assistant
via your assistant	A client signed in through OAuth, or one that named itself, under a name Attensira does not recognise
via the API	A REST call with an API key that did not say what made it

A REST caller can name itself with the X-Attensira-Client header, for example X-Attensira-Client: n8n. Work you do yourself in the dashboard is never marked. The mark is a label and nothing more. A client chooses what it calls itself, so the name never grants or limits anything: what a client can do is decided only by the access you approved or the key’s scope.

Any other MCP client

Any client that supports remote MCP servers can connect with these facts:

Connection details

URL:       https://mcp.attensira.com/mcp
Transport: Streamable HTTP (POST + SSE response stream). No stdio, no plain SSE transport.
Auth:      OAuth 2.1 — discovery at /.well-known/oauth-protected-resource
           or Authorization: Bearer atn_live_<32 hex>

Client authors: the full wire detail — endpoints, scopes, PKCE, registration, token lifetimes — is in the OAuth reference. If the client speaks stdio only, run the bridge locally and point the client at it. Omit --header to let the bridge run OAuth for you:

Shell

npx -y mcp-remote https://mcp.attensira.com/mcp \
  --header "Authorization: Bearer ${ATTENSIRA_API_KEY}"

To confirm the endpoint is reachable before you debug the client, request the unauthenticated health path:

Shell

curl -i https://mcp.attensira.com/healthz

Connected. Ask your assistant to call get_account — it answers without you supplying a workspace id, and its workspaces array is what every other tool’s project takes. With one workspace it is also named as project; with several, project is null until you name one, which is expected rather than a fault.

If a client stays silent or shows no tools, see Troubleshooting.

Get started

What you track

Reading the numbers

Pages and AI traffic

The agent

MCP

REST API

Agencies and client reporting

Account

Reference

Connect a client

Which credential to use

Which clients need a bridge

Connecting with OAuth

Claude.ai and Claude Desktop

Claude Code

Cursor

VS Code + Copilot

ChatGPT

Zed

Older builds and stdio-only clients

What you are approving

Connecting with a static key

Get a key first

n8n

Codex CLI

Windsurf

Cline

Claude Desktop and Claude Code with a key

Marked via your assistant

Any other MCP client

​Which credential to use

​Which clients need a bridge

​Connecting with OAuth

​Claude.ai and Claude Desktop

​Claude Code

​Cursor

​VS Code + Copilot

​ChatGPT

​Zed

​Older builds and stdio-only clients

​What you are approving

​Connecting with a static key

​Get a key first

​n8n

​Codex CLI

​Windsurf

​Cline

​Claude Desktop and Claude Code with a key

​Marked via your assistant

​Any other MCP client

Which credential to use

Which clients need a bridge

Connecting with OAuth

Claude.ai and Claude Desktop

Claude Code

Cursor

VS Code + Copilot

ChatGPT

Zed

Older builds and stdio-only clients

What you are approving

Connecting with a static key

Get a key first

n8n

Codex CLI

Windsurf

Cline

Claude Desktop and Claude Code with a key

Marked via your assistant

Any other MCP client