Skip to main content
Preview. You will mint a key, point one client at the server, and watch a model call a tool against your own workspace.

1. Mint a key with mcp:connect

In the dashboard, Developers → API keys → Create key. The key is a workspace credential with the tgcc_ prefix, and it is shown once.
scope
required
Reaching the transport at all. Without it, POST /mcp is 403.
scope
Each tool demands its own scope on top — agents:read to list agents, documents:create to upload one, and so on.
mcp:connect on its own authorises nothing. A key holding only that scope connects and lists every tool — and calls none of them. That is deliberate: connecting is one decision, and what a model may then do with your workspace is another. Grant the per-tool scopes you actually intend, and no more.

2. Check the endpoint answers

The transport is JSON-RPC 2.0 over POST to one URL. initialize needs no arguments worth writing down, and it is what every shipping MCP client sends today:
A 200 carrying "protocolVersion": "2025-06-18" means the credential is good and the server is reachable. A 401 means the key was not recognised; a 403 means it lacks mcp:connect. Both are covered in Authentication.

If your client speaks 2026-07-28

There is no handshake to run — that revision removed it. server/discover answers the same question, and the request declares its own revision instead of agreeing one:
You do not need this to connect. The 2025-06-18 calls above are the default path and will stay one — the era is chosen by the MCP-Protocol-Version header alone, and an absent header still means 2025-03-26. Protocol revisions covers what a modern client must send on every request, and the error codes it gets for leaving a piece out.

3. See what the key may call

tools/list is the honest answer to “what exists” — it is filtered by nothing, so a key holding only mcp:connect still sees the whole catalogue. The registry is curated and still growing, so this call, not a table in these docs, is what is current for your connection.
The modern result carries the same tools array plus ttlMs and cacheScope, the freshness hints that revision requires — worth honouring, because this server declares listChanged: false and can never tell you the catalogue moved.

4. Point a client at it

Claude

A custom connector on claude.ai or Claude Desktop.

Claude Code

claude mcp add, and a .mcp.json the team shares.

ChatGPT

Connector in the chat UI, or the Responses API mcp tool.

Grok

A custom connector, or the xAI API’s remote MCP tool.

Cursor

One mcp.json entry.

VS Code

One .vscode/mcp.json entry, agent mode on.

Something else?

Windsurf, Zed, Cline, Continue, Goose, Junie, LibreChat, Warp and n8n all connect, and so does anything built on an MCP SDK. Nothing here checks which client is calling.

5. Ask for something

List the agents in my workspace.
The model calls a read tool, gets a JSON payload, and reads it back to you. Then try something that spends:
Upload this contract and pull out the parties, the term and the notice period.
That one uploads a document, waits for it to parse, starts an extraction and polls a job. It also costs credits — see Credits. The scopes the set can ever need are advertised separately, and need no credential at all:
Four kinds of work never answer inline. Extractions, reports, knowledge ingestions and jobs all hand back a job id instead of a result, and the model has to poll. A client that reports “started” and stops is behaving correctly; ask it to check the job. Tools explains why.