Atrix MCP

Your workspace, inside the assistant you already use

One URL connects Atrix to Claude, ChatGPT, Codex, Cursor and anything else that speaks MCP. Thirty-eight tools across your products, work, ideas, pages and customers — and a credential that can never do more than the person who made it.

Connect in a minute Create a token

120

calls a minute

per token

writes a minute

counted separately

tools

19 read, 19 write

grantable scopes

6 asked for by name

Setup

Pick your client. It takes about a minute.

Every one of these signs you in through your browser, so no key is ever pasted into a config file. If you would rather hold a token yourself, each tab says how.

The terminal client. One command adds the server; the first tool call walks you through sign-in in a browser.

What you need: Nothing to paste. Step 2 signs you in and stores a scoped token for you — a bearer token is only for CI, and the note below says how.

Add the server. No credential goes in this command.

bash

claude mcp add --transport http atrix https://atrix.dev/api/mcp

2
Run /mcp inside Claude Code and choose Authenticate. A browser opens, you pick the workspace and the scopes, and the token is stored for you.
text
```
/mcp
```
3
Check it took.
bash
```
claude mcp list
```

Prefer a token you control? Skip the browser entirely with --header "Authorization: Bearer atx_pat_…".

Add Atrix as a custom connector. There is nothing to install and nothing to paste but the URL — the sign-in happens in the app.

What you need: Nothing to paste but the URL. Claude signs you in and registers itself.

1
Open Settings → Connectors → Add custom connector.
2
Paste the endpoint and save.
text
```
https://atrix.dev/api/mcp
```
3
Click Connect. You will be asked which workspace, and which of the scopes below to grant. Approve, and the tools appear in the composer.

Claude registers itself automatically — there is no client ID to create and no secret to store.

Atrix ships the search and fetch tools ChatGPT's connectors and Deep Research require, so your workspace is searchable the same way the web is.

What you need: Nothing to paste but the URL. ChatGPT signs you in when you connect.

1
Open Settings → Connectors → Create, and choose an MCP server.
2
Paste the endpoint.
text
```
https://atrix.dev/api/mcp
```
3
Sign in when prompted, and pick the scopes. Deep Research will then search pages, products, ideas and work items, and fetch any result in full.

search matches page bodies, not just titles — which is what you want, given how many pages are called Untitled.

Two commands: one to add the server, one to sign in.

What you need: Nothing in the config file. The second command signs you in; a bearer token is only for CI, as below.

Add it. No credential goes in this command.

bash

codex mcp add atrix --url https://atrix.dev/api/mcp

2
Sign in.
bash
```
codex mcp login atrix
```
3
Confirm.
bash
```
codex mcp list
```

For CI, where no browser exists: codex mcp add atrix --url … --bearer-token-env-var ATRIX_TOKEN.

Any client that speaks Streamable HTTP works. Most of them take the same JSON.

What you need: Either — OAuth if the client can open a browser, a token if it cannot. Both shapes are below.

1
Add Atrix to the client's MCP config — .cursor/mcp.json for Cursor, and the same shape almost everywhere else.
json
```
{
  "mcpServers": {
    "atrix": {
      "url": "https://atrix.dev/api/mcp"
    }
  }
}
```

If the client cannot do OAuth, hand it a token instead.

json

{
  "mcpServers": {
    "atrix": {
      "url": "https://atrix.dev/api/mcp",
      "headers": { "Authorization": "Bearer atx_pat_…" }
    }
  }
}

It is an HTTP endpoint speaking JSON-RPC. No SDK required, though the official MCP SDKs work unchanged.

What you need: This is the one that needs a token. Create one in settings, and export it as ATRIX_TOKEN.

List what your token may call.

bash

curl -s https://atrix.dev/api/mcp \
  -H "Authorization: Bearer $ATRIX_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Call one.

bash

curl -s https://atrix.dev/api/mcp \
  -H "Authorization: Bearer $ATRIX_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call",
       "params":{"name":"search","arguments":{"query":"pricing"}}}'

The transport is stateless, so there is no session to keep alive and no ordering to preserve. Every request stands alone.

Two ways in, for two different situations

Sign in — for anything with a browser

Full OAuth 2.1: dynamic registration so there is no app to create, PKCE on every exchange, refresh tokens, and a consent screen that names the workspace and every scope before you approve it. Revoke it later without changing your password or disturbing anyone else.

RFC 6749 · 7591 · 7636 · 8252 · 8414 · 8707 · 9728 · 7009

An Atrix Token — for scripts, CI and servers

Mint one in settings, tick the scopes, choose 30 days, 90 days, a year or no expiry. It is shown once. It begins atx_pat_ so a leaked one is recognisable in a log or a gist at a glance, and it is stored hashed — we cannot show it to you again, only replace it.

Create one

Scopes

Nineteen things you can grant, and nothing implied

No scope quietly includes another. Reading customers does not let you see what a deal is worth; managing the team does not let you read employment records. If it is not ticked, it is not granted.

Read

projects.readRead products
work.readRead work
ideas.readRead ideas
prototypes.readRead prototypes
pages.readRead pages
feed.readRead the feed
messages.readRead messages
people.readRead the team
crm.readRead customers

Write

A write scope never implies its read scope, and no scope implies another.

ideas.writeChange ideas
work.writeChange work
pages.writeChange pages
crm.writeChange customers

Asked for by name

These are never bundled and never implied. Each one is a separate decision on the consent screen, because each reaches something a colleague would mind.

crm.valueSee deal valuesalso needs the “See deal values” permission
people.recordsSee employment recordsalso needs the “See employment records” permission
feed.postPost updates
hiring.readRead hiringalso needs the “Run hiring” permission
integrations.readRead integrationsalso needs the “Manage integrations” permission
billing.readRead billingalso needs the “Manage billing” permission

What a token cannot do

The interesting half of an integration like this is not the tool list. It is what happens when the model is wrong, the id is somebody else’s, or the person who minted the key has since changed jobs.

A token can never do more than you can

Scopes narrow; they never widen. The permissions you hold in the workspace are intersected with the scopes on the token, and the result is what the tools see. Grant crm.write to somebody who cannot edit customers and it grants nothing at all — there is no combination of scopes that adds an ability you do not already have.

One workspace, fixed at the token

The workspace is closed over by the credential, not passed as an argument. No tool accepts an organisation id, and every query is scoped in the same statement that fetches — so an id from another workspace matches zero rows rather than matching and being caught afterwards.

Every call is written down

Each call records the tool, the outcome, and what it acted on as a kind and an id — never the contents, and never the caller's IP. You can read the trail, and revoke any token, from workspace settings.

Refusals are sentences

A tool your token cannot call is not offered, and calling it by name anyway returns why in a line a model can act on — not an opaque error it will retry forever.

The surface

Thirty-eight tools

Your client only ever sees the ones your token can call, so a model is not tempted by a tool it will be refused.

Find things

2 tools

search · fetch

Products & work

6 tools

projects_list · work_list_issues · work_create_issue · work_update_issue · work_set_issue_status · work_schedule_issue

Ideas

7 tools

ideas_list · ideas_create · ideas_update · ideas_set_brief · ideas_set_status · ideas_add_signal · ideas_promote

Pages

5 tools

pages_list · pages_get · pages_create · pages_append · pages_replace

Customers

7 tools

crm_list_deals · crm_create_company · crm_create_contact · crm_create_deal · crm_update_deal · crm_move_deal · crm_add_deal_note

The feed

3 tools

feed_list · feed_post_update · feed_comment

People & the workspace

8 tools

workspace_overview · people_list · people_get_record · prototypes_list · messages_list_conversations · hiring_list_roles · integrations_list · billing_overview

Questions people actually ask

Do I need to create an OAuth app or client ID?+

No. Atrix supports dynamic client registration, so Claude, ChatGPT and Codex register themselves the first time they connect. There is nothing to create in advance and no client secret to store anywhere.

When should I use an Atrix Token instead of signing in?+

Use OAuth for anything with a browser — it is the safer path, and the token is scoped, refreshable and revocable without touching your password. Use an Atrix Token for scripts, CI and servers, where nobody is present to approve a consent screen. Tokens start with atx_pat_ so a leaked one is recognisable on sight, and you choose 30 days, 90 days, a year, or no expiry.

Can a token read salaries?+

No. Pay is deliberately outside what any token can be granted: it is not in the list of grantable scopes, and no tool selects a compensation record. Employment records are reachable only with the people.records scope, only by somebody whose own permissions allow it, and only for people they outrank.

What happens if somebody's permissions change after I mint a token?+

The token follows them. Permissions are resolved per call rather than frozen at mint time, so revoking somebody's access to customers immediately stops every token they created from reading customers — you do not have to hunt the tokens down.

Does an agent editing a page interrupt someone typing in it?+

No. Pages are collaborative documents, and an appended block merges into the live document the way another person's typing would. Their cursor does not move, their undo history survives, and nothing either of you wrote is lost.

Which MCP clients are supported?+

Any client that speaks Streamable HTTP, which is all of the current ones. Atrix implements the discovery documents defined by RFC 9728 and RFC 8414, so a well-behaved client finds the authorization server on its own from a single URL.

Point your assistant at it

Start read-only if you like — grant the reads, see what your assistant does with them, and widen it later. Scopes are changed by minting a new token, and revoking is instant.

Create a token Talk to an engineer

curl -s https://atrix.dev/api/mcp \ -H "Authorization: Bearer $ATRIX_TOKEN" \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'