Connect an AI client with MCP

Under development. InBrief MCP is disabled by default. These instructions describe the implementation being prepared; they do not announce a live endpoint or approved directory listing. The planned product inventory is broader than the currently registered tools. Check your installation's MCP settings for the tools it actually offers.

Before connecting

1. Your deployment administrator enables MCP. Your account owner opens Settings → MCP connections, enables account access and checks the maximum tools and pages that users may delegate.
2. Copy the MCP endpoint shown in settings. Examples below use https://inbrief.example/api/mcp; replace it with that URL.
3. Use a client with remote Streamable HTTP and OAuth support. Connectors using only local stdio need a different client setup.

Choose access for each client

Start the connection from your client. Sign in to InBrief, give the connection a recognizable name, then check each allowed tool and status page. Nothing starts checked. Read tools describe the data they return; change tools describe their effects. A tool marked Finish in InBrief requires you to complete the action in the authenticated product UI.

Approve only a connection you started. Client names are supplied by the client and are not a verified publisher badge. Selected data is sent to that client and handled under its policies. Your current role, account policy and feature availability still apply. Choosing all current pages does not include future pages.

Claude, ChatGPT and another editor each receive a separate connection. InBrief checks allowed tools on every call. Client-side approval preferences can further restrict calls, but cannot expand InBrief permissions.

Create a status page

When your installation offers create_status_page, an account owner or admin can select it for a connection. Supply the page address, display name, default language and an idempotency key. The account's page allowance, reserved addresses and pending page deletions still apply.

If a response is interrupted, retry with the same arguments and idempotency key. The response includes the page ID, address and hostname. It also returns connectionAccessGranted: false: creation does not grant the client access to the new page. Explicitly select that page in your MCP permissions before using page tools on it.

Export subscribers in your browser

Select export_subscribers to let a client request an export review for an allowed page. Open that review in InBrief, confirm your identity and approve the download. Subscriber addresses remain in the browser download; MCP receives no file contents or download credentials.

The approving browser receives a one-use download cookie. Download the file from that review page. Reloading the review or retrying approval does not recover the download. Start a new review if needed.

Select get_subscriber_export_status separately to let the same client read safe status using the action ID. Approval means the download was granted; the export state reports whether the browser finished downloading it. Status requires the original actor and connection, current export permission and the approving browser session. Revoking that session also removes this status access.

Claude and ChatGPT

For Claude, add a custom connector in its connector settings, enter your InBrief MCP URL and complete OAuth. For ChatGPT, use its custom MCP/app connection flow where developer mode and workspace policy permit it. Select OAuth and enter the same URL. Menu availability depends on your client account and workspace policy. Public directory discovery is a separate submission and review process.

Use the remote-connector settings in Claude Desktop for this HTTP server. Do not assume every desktop JSON format accepts a remote URL. Follow Claude's connector guidance or OpenAI's connection guidance.

JSON and TOML configurations

Merge the relevant entry into your existing file. Keep other servers and settings. These examples contain no API keys, tokens or client secrets: your client performs OAuth in the browser. Configuration formats were checked against the linked client documentation on 6 September 2026; end-to-end InBrief compatibility is still being verified. An older client version may use a different format.

Claude Code

File: .mcp.json. Client documentation.

{
  "mcpServers": {
    "inbrief": {
      "type": "http",
      "url": "https://inbrief.example/api/mcp"
    }
  }
}

Cursor

File: .cursor/mcp.json. Client documentation.

{
  "mcpServers": {
    "inbrief": {
      "url": "https://inbrief.example/api/mcp"
    }
  }
}

VS Code / GitHub Copilot

File: .vscode/mcp.json. Client documentation.

{
  "servers": {
    "inbrief": {
      "type": "http",
      "url": "https://inbrief.example/api/mcp"
    }
  }
}

Gemini CLI

File: .gemini/settings.json. Client documentation.

{
  "mcpServers": {
    "inbrief": {
      "httpUrl": "https://inbrief.example/api/mcp"
    }
  }
}

OpenCode v2

File: opencode.json. Client documentation.

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "servers": {
      "inbrief": {
        "type": "remote",
        "url": "https://inbrief.example/api/mcp"
      }
    }
  }
}

Windsurf / Devin Desktop

File: ~/.codeium/windsurf/mcp_config.json. Client documentation.

{
  "mcpServers": {
    "inbrief": {
      "serverUrl": "https://inbrief.example/api/mcp"
    }
  }
}

Codex

File: ~/.codex/config.toml. Client documentation.

[mcp_servers.inbrief]
url = "https://inbrief.example/api/mcp"

Command-line setup

Claude Code can add the same entry directly. Run /mcp inside Claude Code to authenticate:

claude mcp add --transport http inbrief https://inbrief.example/api/mcp
claude mcp add-json inbrief '{"type":"http","url":"https://inbrief.example/api/mcp"}'

Choose either Claude command, not both. For Codex, add the URL and start OAuth:

codex mcp add inbrief --url https://inbrief.example/api/mcp
codex mcp login inbrief --oauth-client-registration dcr

In Gemini CLI, use /mcp auth inbrief when prompted. Other clients expose a connect or authenticate action beside the configured server. Allow the browser callback to complete.

Verify the connection

1. For a small first check, approve get_account, list_status_pages and one page.
2. Ask: “Which InBrief account am I connected to, and which status pages can this connection access?”
3. Check the returned account and page against your selection. Unselected pages must not appear.
4. Remove get_account in MCP settings. A fresh or manually constructed call must be refused.

Current tools in source

This source contains 167 tools, including WhatsApp sender connection and refresh, account deletion review, status-subscription preference changes and unsubscribes, Database Health connection creation, replacement and testing, personal WhatsApp request, verification and removal, outage installation credential review, event storage configuration, Slack credential management, filtered audit export, subscriber destination credential reviews, WhatsApp receiver verification and billing-settings navigation. MCP remains disabled by default; deployment does not mean that client access is enabled or that a directory listing is approved. Product coverage is still incomplete. Page-scoped tools require an explicitly selected pageId. Check your installation's MCP settings for the tools it actually offers.

Read and write labels describe the product operation. Every tool call also records private MCP activity, so the protocol advertises readOnlyHint: false. Calls without a command receipt advertise idempotentHint: false because repeated calls add separate activity records. Receipt-backed commands keep their documented retry guarantees. Tool selection and current product permissions still determine which operations a connection may perform.

Audit history returns newest events first. Pass nextCursor as cursor for the next batch. An optional pageId limits results to that selected active page. Without it, the account view also includes six actions with no page: team.member_invited, team.member_role_changed, team.member_removed, audit_log.exported, security.step_up_completed and security.step_up_denied. Account and page filters apply before pagination.

Monitor, incident, template, API key, webhook and webhook delivery lists return ascending IDs. Pass nextAfterId as afterId to read another page. The team roster uses ascending email order; pass nextAfterEmail as afterEmail. For incident updates, pass nextAfterUpdateId as afterUpdateId; use sequence and createdAt to interpret their chronology. A null cursor marks the end. Lists default to 10 records, with a maximum of 25. Incident updates default to 5, with a maximum of 10.

Subscriber and endpoint lists also use nextAfterId. Subscriber email scope returns at most 100 service slugs, with serviceScopeCount and serviceScopeTruncated indicating the complete stored scope's size. Notification templates follow catalogue order using nextAfterKey, with a maximum of 10 templates per page. Public summary/history services use ascending slugs and nextAfterServiceSlug. Public incident, feed and calendar results are bounded snapshots; they do not expose the same cursor as private incident lists.

For monitor, incident, template and postmortem reads, specify language or omit it to use the page default. Missing incident translations are empty. For postmortems, version selects draft or published and does not change publication. These reads never translate or publish content.

A monitor's recordedState is its stored last state. Use observation for outbound probe freshness. Heartbeat observation, monitoring enablement and effective outbound interval are null because this read does not evaluate the inbound heartbeat lifecycle.

Internal rule lists return up to 100 rules in ascending ID order; pass nextAfterRuleId as afterRuleId. The omission flags selectorOmitted, regionOmitted and channelIdsOmitted identify legacy values that exceed the contract's bounds. The derived sentence is null when its inputs are omitted. Rule configuration can contain writer-authored paths; viewer-readable analytics does not return raw observed paths. Endpoint lists return up to 100 metrics and require the same snapshot selection when continuing with a cursor.

Write custom incident templates

create_incident_template, update_incident_template and delete_incident_template manage custom templates. Create requires the page, template draft and an idempotencyKey. Update also requires the custom template's templateId and current template.expectedRevision. Both save the supplied draft and return its current translationStatus. They do not call or schedule automatic translation.

Delete requires the selected page, templateId, current expectedRevision and an idempotencyKey. Read the template again before updating or deleting if its revision has changed. If a response is lost, retry the same tool with the same key and arguments. InBrief returns the stored result, including its receipt ID, without applying the write again. Reusing a key with different arguments returns CONFLICT.

Read connection context and outage templates

get_console_context returns your account ID, email, current role, selected active pages and the selected tools currently available to your connection. It does not grant additional permissions. Each later call checks access again. Page discovery has a 1000-page limit. pageSelection.limitReached reports that the discovery ceiling was reached; it does not count omitted selected pages.

get_outage_snippets returns installation templates for a selected page. Worker and nginx templates contain INBRIEF_REROUTE_KEY_REPLACE_IN_BROWSER instead of your reroute key. They are incomplete. Use the credential-bearing snippets in InBrief's browser console to prepare the final configuration. Never paste your key into an agent conversation. The static error-page variant needs no credential, but cannot show live incident text. Unconfigured rerouting returns snippets: null. Reading templates does not install or verify your infrastructure.

Review an outage-code change

configure_outage_code is available to owners and admins when the page's maintenance-mode feature is available. Select this tool and the page explicitly. A request stores the submitted and sanitised CSS/HTML for review; it does not change outage-page settings. Do not include secrets or credentials in code.

1. Submit the proposal with operation.kind: request and an idempotencyKey. Retry a lost response with the same key and arguments.
2. Open the returned InBrief review URL as the same person who connected the client. Check the account, page, escaped code and the changes made by the sanitiser.
3. Use the review screen to request an identity-confirmation email. Complete the scoped email challenge, then return to the review screen and explicitly approve the displayed change.
4. Read the outcome in InBrief, or use operation.kind: status with the returned actionId. A pending response means approval is still required.

The request expires within 15 minutes, and sooner when its original access token or connection expires. Refreshing the client's token does not extend that request. If the page's theme changes or access is revoked, approval is refused. Request a new review of the current state. Cancellation changes no outage-page settings. Completion and cancellation clear the stored proposal code; expired pending rows are scheduled for cleanup 24 hours after expiry. Account deletion also removes pending proposals.

Use update_branding for appearance settings and configure_outage_code for outage-page custom CSS/HTML. Credential-bearing outage install snippets and the authenticated reroute-state IP allowlist are not public MCP output.

Review outage installation credentials

The source implementation of manage_outage_credentials supports operation.kind: request with action: generate or action: reveal, followed by operation.kind: status and its actionId. Select this tool and the page separately. Owners and admins with Outage continuity open the review in InBrief, confirm their identity and explicitly approve. The credential appears only in that browser; the agent receives safe status. Generation keeps an existing key unchanged, and this flow does not rotate or remove it. Repeat reveal requires a new review and confirmation.

Ordinary outage setup also requires identity confirmation before generating or revealing its credential. Loading safe settings does not. These actions do not install routing or prove that traffic will reroute. Access requires an enabled MCP deployment and an explicitly selected tool and page. Live routing must be verified separately.

Review webhook and API-key changes

Select each tool and page explicitly. create_webhook, update_webhook, delete_webhook, create_api_key and revoke_api_key prepare a review; the MCP request alone does not apply the change.

1. Ask the client to prepare the change with operation.kind: request and an idempotencyKey. For an existing resource, supply its current revision from the relevant list.
2. Open the returned InBrief review URL as the person who connected the client. Check the account, page, resource and proposed effect. For a new webhook, enter its receiver URL directly in this screen.
3. Confirm your identity using the email challenge, return to the same browser review and approve. You can cancel a pending review without changing the resource.
4. Copy a newly created API key or webhook signing secret from the browser response and store it securely. It is shown once. MCP results and replayed approvals do not reveal it.
5. Use operation.kind: status and the returned actionId to check completion.

A webhook update changes subscribed events or active state; it does not replace the receiver URL. API-key revocation requires the current key revision. Revocation is permanent. A review expires within 15 minutes, or sooner if its original token or connection expires. Changed permissions, revoked access, an expired identity proof or a changed resource revision can prevent approval.

Review subscriber destination credentials

The credential workflow adds separate selections for create_subscriber_endpoint, replace_subscriber_endpoint_credentials and revoke_subscriber_endpoint. Open the returned review link, check the page and provider, confirm your identity, and enter credentials only in the authenticated browser. Never paste bot tokens, webhook URLs or chat IDs into an agent conversation or MCP JSON configuration.

Discord and Teams save after approval. Telegram approval first schedules a verification challenge. A successful send saves a pending destination. Select verify_subscriber_endpoint separately to open an authenticated room-code review. Enter the code only in the browser; this verification tool sends no extra challenge. An unknown provider result is not retried automatically and does not publish a new destination. Refresh the review to see its current status. Test delivery requires the separate send_subscriber_endpoint_test selection.

Credential replacement is a separate permission from changing a destination name, language, service selection or enabled state. Current role, page access, provider availability, connection selection and request expiry are checked again before the change takes effect.

Review heartbeat credentials

The next tool batch adds issue_heartbeat_credential, rotate_heartbeat_credential and revoke_heartbeat_credential. Availability depends on the deployed tool catalog and your selected tools. Each accepts a pageId and a request with the matching kind and monitorId. Open the returned review URL, confirm your identity and approve the change. The review binds the current credential revision; if someone rotates or revokes it first, request a new review.

Copy the success, start and failure URLs from the browser after issue or rotation. They appear once and are never returned to MCP. Rotation preserves the existing overlap for installing the new credential. Revocation disables active and retiring credentials. Owners and admins can revoke after the heartbeat entitlement ends when the page still permits changes. Page access restrictions remain in force. Cancelling a review does not change any credential.

Translate one record

translate_monitor and translate_incident inspect missing text with operation.kind: inspect. Supply the returned revision as expectedRevision, an idempotencyKey and operation.kind: request to queue translation. Use operation.kind: status with the returned operationId to read the outcome.

Acceptance means the request was saved. The worker uses the configured AI provider and shares the account's daily translation allowance with other translation workflows. It rechecks current access, page languages and source text before sending, and preserves human translations. Heartbeat monitor translations require an Account owner or admin. An uncertain provider outcome stops automatic resends; a new request can incur another provider charge. No source text, prompt or credentials are accepted from the agent.

Manage chat destination details

update_subscriber_endpoint, enable_subscriber_endpoint and disable_subscriber_endpoint are separate permissions for existing Discord, Teams and Telegram destinations. Select the tool and page, then use list_subscriber_endpoints to obtain the endpoint ID, updatedAt and credentialRevision. Pass those values as endpointId, expectedUpdatedAt and expectedCredentialRevision, with an idempotencyKey.

Updates change only the name, enabled page language and service scope. Enabling a destination requires its existing verification and credential. Owners and admins can use these tools when the provider is available to their account. Credential setup, replacement, revocation and verification use their separately selected browser-review tools. send_subscriber_endpoint_test requests a test with the same endpoint revision values. Use request.kind: send to request delivery and request.kind: status with request.operationId set to the returned operation.id to check the result. The tool sends the standard test message; it accepts no message text or credentials. A successful test can activate a pending or disabled destination. A queued response is not delivery confirmation. Unknown delivery is not automatically resent, and a late result cannot alter replaced or revoked credentials.

Change an existing subscription

Owners and admins can select request_subscription_change and provide the complete selection and page quantity. The tool returns an InBrief review link. It cannot accept a price, account ID or confirmed=true as payment authority.

Open the link in the requesting person's browser. Confirm your identity, choose Review current price, and check the selection, page quantity, renewal subtotal and immediate charge preview before approving. Additions apply a prorated change now; reductions wait for the reviewed renewal date. The price review lasts 60 seconds. A changed or expired quote requires another review.

For paid additions, the provider calculates proration when the change is applied. InBrief checks the current quote before sending, but the provider does not offer an atomic price lock. Timing and changes made directly in the provider's portal can still affect the final charge. If the provider cannot quote an immediate amount, this MCP workflow stops before approval.

An accepted request is not a confirmed payment. Paid access updates through the existing payment webhook. If the result is unknown, use Check provider result; do not submit another charge. InBrief keeps the unresolved operation and does not resend it automatically.

The regular Billing screen also requires identity confirmation before committing a subscription change. Previewing a price does not require that proof. Financial workflows remain subject to each client directory's financial-action rules; availability in InBrief does not imply directory acceptance.

Undo a subscription change or cancellation

Owners and admins can select keep_subscription_selection to undo a pending configuration change, or resume_subscription to undo an upcoming cancellation. Supply an idempotencyKey for the request and reuse it if the response is lost. Resume does not restart a paused subscription. Open the InBrief review link, check the configuration, quantity, monthly subtotal before taxes and effective date, then confirm your identity by email. Return to the original browser tab and explicitly approve. Neither operation charges immediately.

Keep using the existing action to check its outcome. A checking response means the provider result is unresolved; starting another action can create conflicting work. InBrief checks provider state before and after the change, but a change made through the provider portal can still race with it. Subscription changes use the browser approval described below.

Subscription checkout

Select open_subscription_checkout for the connection. Send the desired selection, page quantity and an idempotency key. InBrief calculates the quote for the connected account; the tool does not accept an account ID, price or model approval.

Open the returned review URL in InBrief using the original account and browser session. Review the server quote, confirm your identity by email, then choose to prepare checkout. This approval may create the Paddle customer and address prefill and a checkout transaction. It does not pay for or activate the subscription.

When checkout is ready, load the payment window and explicitly continue to payment. InBrief checks access again before opening Paddle. Complete payment there. Subscription activation still follows the existing verified payment processing. If preparation remains uncertain, refresh the review for its recorded status; InBrief does not automatically repeat the provider request. Do not create another request merely to retry an uncertain preparation.

Financial-action restrictions still apply to directory submissions. A working InBrief checkout flow does not establish Claude or ChatGPT directory eligibility.

Request webhook delivery

send_webhook_test requests a test for a selected webhook. redeliver_webhook requests another attempt for a selected delivery. Both require current permission, the webhook revision and an idempotencyKey. An accepted request means work was saved, not that the receiver accepted it. Use operation.kind: status with the returned operationId to check its outcome.

Retry a lost acceptance response with the same arguments and key. This does not create another operation. Receiver delivery can still be repeated after an interrupted attempt; receivers should handle repeated envelope IDs. Receiver URLs, signing secrets and raw delivery bodies are not MCP output.

Read the public outage representation

get_public_outage returns safe branding, the standing message, maintenance state, the latest check time and the newest eligible current incident for a selected page. It returns at most 100 affected services and 100 visible updates, with flags indicating omitted entries. Reroute keys, private allowlist addresses and custom CSS or HTML are excluded.

Publish an incident from Internal traffic

publish_internal_incident is in the next source batch. Select the page and tool, then use the current Internal snapshot to choose the affected interval, monitors and impact. InBrief recalculates that selection before accepting the incident. If traffic data changed, refresh the snapshot and review the proposed incident again. An accepted response means the incident and first update were saved with notification work; it does not confirm that subscribers received a message.

Use the same idempotencyKey and arguments after a lost response. Current permission and subscription checks still apply to a replay.

Retry operational changes

Direct write tools require the role and current feature access stated in each tool description; viewers cannot use them. Postmortem, Internal rule and monitor changes also require an idempotencyKey and the current resource revision where the tool schema requires it. Reuse the same key and exact arguments after a lost response. InBrief returns the stored receipt result after checking current access. A changed argument requires a new request; an old receipt cannot restore revoked access.

Custom domain changes

Use get_custom_domain to read the current binding revision. The connect_custom_domain and disconnect_custom_domain tools open a browser review. Check the hostname and page, confirm your identity, then approve or cancel. Approval queues provider work; it does not mean the hostname is live. Ask the same tool for the action status to check the provider result.

refresh_custom_domain queues a verification check using the current revision. Reuse its idempotency key when retrying, and use its operation ID to read the result. Owners and admins can refresh an existing domain without an active custom-domain subscription. Ordinary active-page and Free page limits still apply. Disconnection can also remove a binding from a selected inactive or noncontinuing Free page, while preserving the connection's selected tools and pages.

An uncertain registration means InBrief could not verify whether the provider accepted it. Contact support with the operation ID before trying to register it again. InBrief keeps the reservation and does not automatically repeat an uncertain registration. Disconnection removes the local address immediately after approval; provider cleanup remains durable if the provider is unavailable.

Email settings and test delivery

Select email tools individually. update_email_settings changes the existing sender's From name. Use the revision from get_email_settings when making a change.

configure_email_credentials opens a browser review for sender addresses, providers and SMTP settings. Enter API keys and SMTP passwords only on that authenticated screen, then confirm your identity and approve the exact proposal. Never paste a credential into an agent conversation or tool call. A blank credential keeps the stored credential only for the same provider. Choosing the default sender clears the custom credential and From settings.

send_test_email queues one message to your signed-in email address. It cannot send to an arbitrary recipient. Wait at least 60 seconds between test requests on the same page and read the operation status: sent confirms provider acceptance, logged means no live provider was used, and uncertain means the provider outcome is unknown. An uncertain test is not automatically resent. Queued tests older than 15 minutes are cancelled before delivery.

Your personal WhatsApp subscription

Select request_whatsapp_subscription, verify_whatsapp_subscription and remove_whatsapp_subscription separately. Each opens a browser review for your own account identity. Enter your phone number and verification code only in that screen, never in an agent conversation.

Request approval queues a code. Check the action status to distinguish acceptance from confirmed delivery; an uncertain send is not repeated automatically. Enter the delivered code in the verification review. Codes expire after ten minutes and allow five wrong attempts. Repeating the same browser approval does not consume another attempt.

Removal requires approval of the exact reviewed personal number and remains available after the WhatsApp entitlement ends. It removes the number and pending code. Owners and admins with verified numbers receive operational alerts; ordinary members can manage their number but are not alert recipients. Revoking MCP prevents queued delegated sends, but a code already delivered retains its ordinary verification lifetime.

Change or end a status-page subscription

Select update_status_subscription_preferences and unsubscribe_status_subscription separately. Both open the same kind of review as open_status_subscription: your browser continues on the public status page, and the subscription itself only changes when its own mailbox or device answers.

For email, enter the subscribed address and follow the link that arrives. Preferences stay as they were until you do, and an unsubscribe link is only sent to an address that is actually subscribed; every other address receives the same confirmation on screen and no mail. For browser notifications, open the review on the device that holds the subscription: that device proves itself with its own stored credential, so no other browser can change or end it. Reviews last up to 15 minutes and keep the original connection and page permissions.

Database Health connections

Select create_database_connection, replace_database_connection and test_database_connection individually. They are available to owners and admins on pages where Database Health is switched on for your account.

Every one of them opens an authenticated browser review. Enter the engine, hostname, port, database name and read-only credentials only on that screen; never paste a database password into an agent conversation or a tool call. A test makes one real outbound connection through InBrief's existing network policy, is rate limited per page, and saves nothing. Creating or replacing a connection asks you to confirm your identity again. A replacement applies only at the revision you reviewed, clears the stored check history and restarts collection from the next check. The connected client sees the saved connection and its revision, or the test outcome, latency and diagnostic capabilities. It never sees the configuration or the credentials.

Delete your InBrief account

request_account_deletion is owner-only and must be selected on its own. It opens a browser review that names the account email, the status pages that will be deleted and whether an active subscription is cancelled first. Confirm your identity again, type the owner email exactly and approve.

This is permanent. It deletes every status page, subscriber, teammate, integration and MCP connection with the account, and it signs you out of the browser you approved in. An accepted deletion cannot be cancelled from the review. If cancelling the subscription fails, nothing is deleted and the review says why; request a new review after resolving it. A mistyped email deletes nothing and does not consume your identity confirmation.

Reduce or disconnect access

Open Settings → MCP connections and edit your connection. Uncheck tools or pages and save reduced access, or press Disconnect to revoke it. To add access, reconnect from the client and approve a new connection. A revoked connection cannot be reactivated. Signing out of the InBrief browser session does not disconnect an existing MCP connection.

Unused client registrations expire after seven days. If a saved client registration expires, start a new connection in your client. Approved registrations remain valid through their connections' expiry.

Connections expire after 30 days. Access tokens last at most ten minutes and the client renews them with a rotating refresh token. A replayed refresh token revokes the connection; reconnect instead of repeatedly retrying a rejected credential.

Review your activity

In Settings → MCP connections, open Your MCP activity to review your connection changes and tool-call outcomes for the current account. The list covers the last 365 days, newest first. Use Older activity to continue through the history or Latest activity to refresh it. Activity records include tool names and outcomes, without arguments, returned data or credentials. A read result is withheld if InBrief cannot save its activity record.

Protocol and error reference

The endpoint is POST /api/mcp. Use MCP Streamable HTTP with JSON responses and OAuth authorization code with PKCE S256. The resource parameter must exactly match your MCP URL; scope is inbrief:mcp. This scope alone grants no product tool. The server supports dynamic registration of public clients. Existing incident/ingest API keys cannot authenticate MCP.

Tools return structured results limited to 128 KiB. Reduce limit or narrow the query if a result is too large. An isError: true result includes a stable code and a short message. No resource or prompt endpoint provides alternate access to disabled tools.

Deployment and support

Claude and ChatGPT need to reach your HTTPS endpoint. Customer-installed, Hybrid and air-gapped MCP profiles are not yet accepted. Contact the InBrief support channel shown in your installation with your client version, the tool name and the error code. Do not send tokens, cookies, authorization codes or secrets.