MCP server

What is MCP?

The Model Context Protocol is an open standard that lets AI clients (Claude Desktop, ChatGPT, Cursor, VS Code, and others) call tools running on a remote server. There There ships an MCP server, so once you connect your AI client, the assistant can read your tickets, triage them, reply to customers, and edit your knowledge base directly, without leaving the AI client.

Connections are scoped to one user but may grant access to one or more workspaces. The user picks the workspaces on the consent screen. Every tool call runs as that user and obeys the same channel access rules as the dashboard.

Server URL

https://there-there.app/mcp

The endpoint speaks JSON-RPC 2.0 over HTTP and accepts POST requests only. There is also a discovery URL at https://there-there.app/.well-known/oauth-protected-resource that AI clients read automatically to find the OAuth flow.

How to connect

Most clients walk you through OAuth: you click Connect, There There opens a consent screen where you pick the workspace and the abilities to grant, you click Allow, and the client is connected. You never need to copy a token by hand.

Claude Code (CLI)

Run this in your terminal:

claude mcp add there-there --transport http https://there-there.app/mcp

The first time the assistant uses a tool, your browser opens the There There consent screen. After you click Allow you are returned to Claude and the connection is live.

Claude Desktop, ChatGPT, Cursor, VS Code

Each of these clients exposes a "custom MCP connector" or equivalent setting. The exact menu path differs by version, but the only value any of them needs is the server URL:

https://there-there.app/mcp

When the client first calls a tool, it opens your browser, you choose the workspace and abilities on the There There consent screen, and the connection is live.

For clients that take JSON configuration (some Cursor versions, for example) the entry looks like:

{
    "mcpServers": {
        "there-there": {
            "url": "https://there-there.app/mcp"
        }
    }
}

Other clients

Any MCP client that supports HTTP transport with OAuth 2.1 (PKCE with the S256 challenge method, plus Dynamic Client Registration as defined in RFC 7591) will work. Point it at the server URL and it will discover everything else through /.well-known/oauth-protected-resource.

The consent screen

When an AI client first connects, There There shows a screen where you choose:

1. Which workspaces the connection should be able to act in. Tick one or more. You only see workspaces you belong to.
2. Which abilities to grant. Each ability is a checkbox; the connection cannot use any tool whose ability you did not check.

The same abilities apply across every workspace you ticked. Pick the smallest set you need.

You can revoke the connection at any time from Settings, Connected AIs.

Acting in multiple workspaces

If you ticked more than one workspace, every tool call carries a workspace_id argument that picks which workspace it acts on. The AI sees the list of granted workspaces (with their names and ids) in the server instructions, so when you say "tickets in Spatie" the assistant picks the right id automatically.

If you only ticked one workspace, workspace_id is optional. The connection defaults to that workspace and the AI does not need to think about it.

Abilities

Abilities are what the AI client is allowed to do. There There has four:

Pick the smallest set you need. A connection with only mcp:read cannot accidentally reply to a customer, even if the AI tries.

The reply ability is flagged on the consent screen because the customer sees the result. The other abilities are internal.

Tools

The tools available to a connection are filtered by the abilities you granted. A connection without mcp:tickets:reply will not even see reply-to-ticket-tool in its tools list.

Read tools (mcp:read)

Triage tools (mcp:tickets:manage)

Reply tools (mcp:tickets:reply)

Knowledge tools (mcp:knowledge:write)

Channel access

If your team uses restricted channels (channels not all members can see), AI tool calls obey those rules. The connection can only see and act on tickets in channels you yourself have access to. Tickets in channels you cannot access return "not found" rather than a permission error, so the AI cannot probe for their existence.

Audit trail

Every tool call is logged in the workspace with the tool name, the user, the connection, the duration, and whether it succeeded. You can review activity for a connection by clicking it in Settings, Connected AIs.

Sensitive fields are redacted in the audit log. The body of a reply, forward, or note, the subject and body of a new outbound ticket, and the title and body of a created or updated brain article are all replaced with [REDACTED] in the log entry. Recipient lists on replies, forwards, and outbound tickets are also redacted. The actual message or article keeps the original content; only the audit row is masked.

Managing connections

Settings, Connected AIs lists every active AI connection for the current workspace. From there you can:

• See which abilities each connection holds.
• Open a connection to view its recent tool calls and any errors.
• Revoke a connection. Revoking immediately invalidates the connection's tokens; the AI client has to reconnect to use any tool again.

Each user manages their own connections. Other people in the workspace cannot see or revoke yours.

API tokens (advanced)

If you prefer to use a personal access token instead of OAuth, you can mint one in Settings, API Tokens. To call MCP, the token needs at least one mcp:* ability and access to the workspace you want to act in. Send the token in the Authorization header and the workspace id in X-Workspace-Id:

POST /mcp
Authorization: Bearer <token>
X-Workspace-Id: <workspace-id>
Content-Type: application/json

OAuth is recommended for AI clients because the consent flow is friendlier and the connection is per-client. Use API tokens for scripts and CI.

Limits

• Each connection is rate-limited per minute. If you hit the limit, the response is HTTP 429 and the AI client should retry after a short pause.
• Reply and forward bodies are capped at 100,000 characters. Note bodies are capped at 50,000. Brain article bodies are capped at 200,000. These caps prevent runaway prompts from exceeding database column limits.
• Subjects on outbound tickets are capped at 998 characters (the RFC 5322 line limit).

Troubleshooting

The AI client says it cannot connect. Check that you can reach https://there-there.app/mcp from the same machine. Some corporate networks block POST to unknown hosts.

The consent screen says I do not belong to any workspace. You need to be a member of at least one workspace before you can connect an AI client.

A tool returns "not found" for a ticket I know exists. The connection probably does not have access to that ticket's channel. Open the ticket in the dashboard to confirm. If you cannot see it there either, ask a workspace owner to grant access.

The AI keeps asking for permission. Your connection may be revoked or expired. Open Settings, Connected AIs and check whether the connection is still listed. If not, reconnect from the AI client.

My replies are not reaching customers. Verify the channel is configured to send mail (Settings, Channels, the channel's Send section). When you create a new outbound ticket through create-ticket-tool, the tool refuses up front if the channel is not ready to send.