Skip to main content
Insito also runs a hosted MCP server at https://mcp.insito.app/mcp. It exposes exactly the same tools as the npm package, but nothing runs on your machine — your MCP client talks to it over Streamable HTTP. Choose the remote server when:
  • your client supports remote MCP servers with OAuth (like Claude.ai) — you sign in and approve access, no API key to copy. This is the recommended way to connect: there’s no long-lived secret to store or leak;
  • you don’t want to run npx locally, or you’re in an environment without Node.js.
The local @insito/mcp package remains the right choice for stdio-only setups.
MCP access is available on paid plans. Requests from free-plan workspaces are rejected with an upgrade message.

Claude.ai (OAuth — no API key)

  1. In Claude.ai, open Settings → Connectors → Add custom connector.
  2. Enter the server URL: https://mcp.insito.app/mcp.
  3. Claude discovers Insito’s OAuth support automatically and opens a sign-in window. Log in to your Insito dashboard account.
  4. Untick any permission you don’t want Claude to have, then click Approve. Delete surveys stays unticked unless you tick it.
  5. That’s it — Claude can now use the Insito tools in any chat.
You can disconnect at any time from either side: remove the connector in Claude.ai, or revoke the grant in the Insito dashboard under Settings → API keys → Connected apps.

Cursor / Claude Desktop (URL + API key)

Use OAuth if your client supports it. Clients that support remote servers but not OAuth can connect with a dashboard API key (insk_…, created under Settings → API keys) sent as a bearer token:
.cursor/mcp.json
The same block works in claude_desktop_config.json for Claude Desktop versions with remote server support.
The key must be sent in the Authorization header. Query-string keys (?api_key=…) are not supported — URLs leak into proxy and server logs.

How auth works

  • Every request is authenticated. The hosted server forwards your credential to the Insito API on each call, so revoking a key or disconnecting an app takes effect immediately.
  • The server keeps a short-lived session per connection (closed after 30 minutes idle) so it can ask you to confirm destructive actions mid-call. A session only works with the credential that opened it; if it’s gone, your client reconnects automatically.
  • OAuth uses the standard authorization-code flow with PKCE. Claude receives a short-lived access token, bound to https://mcp.insito.app/mcp, and refreshes it automatically in the background; approving the connection is a one-time action.
  • Either way, the connection can only do what its permissions allow, and never reaches billing, members or API keys.

Endpoints