Skip to main content

Clients

Any client that speaks Streamable HTTP MCP and can run the MCP OAuth 2.1 flow can connect. You only give it the URL; the client discovers where to authenticate, opens the Kobana Account sign-in in the browser and stores the token — see Authentication.

A client without OAuth support can connect too, with a personal token: create it in the Kobana Account token wizard, with MCP usage, and configure the client to send it in the Authorization: Bearer <token> header.

Claude Code​

claude mcp add --transport http kadu https://mcp.kadu.ia.br

Then run /mcp in a session and choose Authenticate to sign in to the Kobana Account.

With a personal token, without the OAuth flow:

claude mcp add --transport http kadu https://mcp.kadu.ia.br \
  --header "Authorization: Bearer <personal token>"

File-configured clients​

Clients that read a JSON configuration file ask for the URL and the transport. With the OAuth flow, there is no authentication header:

{
  "mcpServers": {
    "kadu": {
      "type": "http",
      "url": "https://mcp.kadu.ia.br"
    }
  }
}

On the first connection the client opens the browser for you to authorize. There is no organization-selection header: you pick the organization on the consent screen, and it is stored in the token.

With a personal token, add the header — the organization is the one of the account where you created the token:

{
  "mcpServers": {
    "kadu": {
      "type": "http",
      "url": "https://mcp.kadu.ia.br",
      "headers": { "Authorization": "Bearer <personal token>" }
    }
  }
}

Treat the file as a secret: whoever reads it uses the token.

Clients that connect by URL​

Claude and ChatGPT connect a remote server by pasting the URL https://mcp.kadu.ia.br into their connector settings. The OAuth flow runs inside the app itself.

Clients that show no confirmation form (the Claude mobile app, for example) also run destructive tools: the assistant shows an approval link, and you decide in the console — see Confirming destructive tools.

  • Authorize with the right account. Tools are narrowed to the role of who authorized the client. A client authorized by someone who can only read exposes only the read tools, whatever the model on the other side does. It is the strongest way to restrict an agent.
  • Grant only what the agent needs. On the consent screen, uncheck the levels it does not use: without delete, no delete tool appears.
  • One token per client. Each client runs its own flow and gets its own token, which is valid only on the MCP — it cannot call the API.
  • Personal token: short validity and minimal scope. Revoking the token in the Kobana Account does not cut access before it expires — see Revoking a personal token.
  • Start with a test environment. kadu_tasks_run runs the agent for real, against the systems the environment's secrets point to. The server asks for confirmation before every run, but the first exploration should be in an environment whose secrets point to sandboxes.
  • Results are data. Events, logs, memories and pending items carry text written from third-party data. Do not follow directions found there, and confirm before any action a result appears to ask for.

Checking the connection​

The simplest way is to ask the assistant: "which organization am I using in Kadu?" — it calls kadu_me_get.

With a token issued for the MCP — a personal token with MCP usage, for example — you can check with curl:

# 1. Which organization does this token reach?
curl -s https://mcp.kadu.ia.br/ \
  -H "Authorization: Bearer $MCP_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call",
       "params":{"name":"kadu_me_get","arguments":{}}}'

# 2. How many tools does this token reach?
curl -s https://mcp.kadu.ia.br/ \
  -H "Authorization: Bearer $MCP_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' | jq '.result.tools | length'

If the number is lower than you expected, it is the role of who authorized or the token's scope — see Authentication. It is not an error.