> ## Documentation Index
> Fetch the complete documentation index at: https://docs.insito.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Remote server

> Connect to the hosted Insito MCP server at mcp.insito.app — no local install, with OAuth support for Claude.ai.

Insito also runs a hosted MCP server at `https://mcp.insito.app/mcp`. It exposes
exactly the same tools as the npm package, but nothing runs on your machine —
your MCP client talks to it over Streamable HTTP.

Choose the remote server when:

* your client supports **remote MCP servers with OAuth** (like Claude.ai) — you
  sign in and approve access, no API key to copy;
* you don't want to run `npx` locally, or you're in an environment without
  Node.js.

The local [`@insito/mcp` package](/mcp/install) remains the right choice for
stdio-only setups.

<Note>
  MCP access is available on **paid plans**. Requests from free-plan workspaces
  are rejected with an upgrade message.
</Note>

## Claude.ai (OAuth — no API key)

1. In Claude.ai, open **Settings → Connectors → Add custom connector**.
2. Enter the server URL: `https://mcp.insito.app/mcp`.
3. Claude discovers Insito's OAuth support automatically and opens a sign-in
   window. Log in to your Insito dashboard account and click **Approve**.
4. That's it — Claude can now use the Insito tools in any chat.

You can disconnect at any time from either side: remove the connector in
Claude.ai, or revoke the grant in the Insito dashboard under
**Settings → API keys → Connected apps**.

## Cursor / Claude Desktop (URL + API key)

Clients that support remote servers but not OAuth can connect with a dashboard
API key (`insk_…`, created under [Settings → API keys](/mcp/install#get-an-api-key))
sent as a bearer token:

```json .cursor/mcp.json theme={null}
{
  "mcpServers": {
    "insito": {
      "url": "https://mcp.insito.app/mcp",
      "headers": {
        "Authorization": "Bearer insk_your_key_here"
      }
    }
  }
}
```

The same block works in `claude_desktop_config.json` for Claude Desktop
versions with remote server support.

<Warning>
  The key must be sent in the `Authorization` header. Query-string keys
  (`?api_key=…`) are **not** supported — URLs leak into proxy and server logs.
</Warning>

## How auth works

* Every request is authenticated — the hosted server holds no sessions and
  forwards your credential to the Insito API on each call, so revoking a key
  or disconnecting an app takes effect immediately.
* OAuth uses the standard authorization-code flow with PKCE. Claude receives a
  short-lived access token and refreshes it automatically in the background;
  approving the connection is a one-time action.
* Either way, the connection acts on your workspace with your account's
  permissions.

## Endpoints

| Endpoint                                                          | Purpose                                                          |
| ----------------------------------------------------------------- | ---------------------------------------------------------------- |
| `POST https://mcp.insito.app/mcp`                                 | The MCP endpoint (Streamable HTTP).                              |
| `GET https://mcp.insito.app/health`                               | Health check.                                                    |
| `GET https://mcp.insito.app/.well-known/oauth-protected-resource` | OAuth resource metadata (how clients discover the sign-in flow). |