Connecting AI assistants (MCP)

Connect Claude, ChatGPT, Copilot or any MCP client to your BioFlow workspace over OAuth 2.1 — setup per client, the 13 operations, the 6 scopes, and the safety rails.

BioFlow ships a remote MCP (Model Context Protocol) server, so any MCP-capable AI assistant can read and edit your bio pages with your permission.

Setting up a coding agent (Claude Code, Codex, Cursor, Windsurf, VS Code, OpenCode) rather than Claude or ChatGPT directly? Onboard your agent does the whole thing — MCP, REST API and SDKs — from one pasted sentence.

https://app.getbioflow.com/api/mcp

The transport is Streamable HTTP. Authentication is OAuth 2.1 with PKCE and dynamic client registration — no pre-shared API keys. Tokens are scoped to a single workspace, so an agent only ever sees the workspace you connected it to.

MCP access is included on every plan, including Free. Tool calls ride your plan's existing limits; over-limit calls get a structured QUOTA_EXCEEDED response instead of failing silently.

Connect from any MCP client

The Claude button opens the directory listing; the others install directly or jump to the instructions.

BioFlow's MCP server is a hosted Streamable HTTP endpoint with OAuth 2.1 sign-in. There is nothing to install or run: point the client at the URL below and sign in to BioFlow when the browser opens. Every client that supports remote MCP servers with OAuth works; the ones below are the common ones.

https://app.getbioflow.com/api/mcp

Claude (claude.ai, Claude Desktop, Claude Code)

claude.ai / Claude Desktop: fastest — open BioFlow in Claude's connector directory, click Connect, then sign in. Manual alternative: Settings → Connectors → Add custom connector, paste the URL, then sign in.
Claude Code: claude mcp add --transport http bioflow https://app.getbioflow.com/api/mcp then /mcp to sign in.

ChatGPT and Codex

ChatGPT: Settings → Apps & Connectors → Create (developer mode), name it BioFlow, paste the URL, authentication OAuth. If BioFlow is in the ChatGPT plugins directory, enable it from there.
Codex CLI: add to ~/.codex/config.toml:

[mcp_servers.bioflow]
url = "https://app.getbioflow.com/api/mcp"

Cursor

One click: Add to Cursor. Or in .cursor/mcp.json:

{ "mcpServers": { "bioflow": { "url": "https://app.getbioflow.com/api/mcp" } } }

VS Code and GitHub Copilot

One click: Add to VS Code. Or run MCP: Add Server → HTTP and paste the URL, which writes to .vscode/mcp.json:

{
  "servers": {
    "bioflow": { "type": "http", "url": "https://app.getbioflow.com/api/mcp" }
  }
}

Google Antigravity

Install the plugin from the repository (or from the Antigravity Marketplace once listed):

agy plugin install https://github.com/DevinoSolutions/mcp-servers/antigravity-plugins/bioflow

Or add the server by hand in ~/.gemini/config/mcp_config.json (Antigravity requires the serverUrl key):

{
  "mcpServers": {
    "bioflow": { "serverUrl": "https://app.getbioflow.com/api/mcp" }
  }
}

Gemini

Gemini app: Settings → Connected apps → Custom apps → Add a custom app, paste the URL, then mention @BioFlow in a chat. (Custom apps are currently limited to personal Google accounts in the US.)
Gemini CLI: gemini extensions install https://github.com/DevinoSolutions/mcp-servers then /mcp auth bioflow, or add { "mcpServers": { "bioflow": { "httpUrl": "https://app.getbioflow.com/api/mcp" } } } to ~/.gemini/settings.json.

Kiro

One click: Add to Kiro. Or in .kiro/settings/mcp.json:

{ "mcpServers": { "bioflow": { "url": "https://app.getbioflow.com/api/mcp" } } }

Perplexity, Mistral Le Chat, Grok

Perplexity (Pro, Max, Enterprise): Settings → Connectors → Custom connector, paste the URL, authentication OAuth.
Mistral Le Chat (all plans): Intelligence → Connectors → Add Connector → Custom MCP Connector, paste the URL.
Grok: grok.com → Connectors → New connector → Custom, paste the URL.

Other clients

Replit: Add to Replit, or Integrations → Add MCP server.
Devin, Windsurf, Zed, JetBrains Junie, Cline, OpenCode: add a remote (HTTP) MCP server with the URL above; each prompts for the OAuth sign-in on first use.
Microsoft Copilot, MCP Inspector, your own agent framework: point the client at the same URL. Registration is dynamic, so there is nothing to pre-provision on either side. Cline can also install it from the Cline marketplace entry using its llms-install.md.

Tokens are scoped to what you approve on the consent screen; a tool you did not grant is never shown to the assistant. Revoke any connected app at any time from Settings, under Connected AI apps.

Available tools

The server offers 13 operations, each guarded by one OAuth scope.

The server uses Code Mode. Its tool list has two tools, search_tools and execute_typescript, not one tool per operation. Your assistant calls search_tools to find the operations below, then runs a short TypeScript program through execute_typescript that calls them. Each call goes through the same scope, dangerous-operations toggle and audit checks as a direct call. An operation outside the scopes you granted is not offered at all.

The operations:

Tool	What it does	Scope
`page.list`	List every bio page in the workspace: title, slug, publish status, block count, route, and theme	`pages:read`
`page.get`	Read one page's draft and published state — blocks with ids, theme, route, and the draft `updatedAt` that write tools require	`pages:read`
`analytics.summary`	Workspace analytics for the last 7/30/90 days: views, clicks, unique visitors, CTR, top links, referrers, and tip revenue	`analytics:read`
`contacts.list`	List captured contacts and leads (newsletter signups, form submissions, gated downloads), newest first	`contacts:read`
`file.list`	List uploaded files (name, MIME type, public path) for wiring into image, file, carousel, or product blocks	`files:read`
`page.create`	Create a new bio page as an unpublished draft — it never publishes; going live requires `page.publish`	`pages:write`
`page.update_draft`	Edit existing blocks by id (held in the draft until publish) or the page's title, description, or theme (live without waiting for a publish) — everything you don't mention is preserved	`pages:write`
`page.add_block`	Append one new block to the draft, preserving every existing block byte-for-byte	`pages:write`
`page.remove_block`	Delete specific blocks from the draft by id; refuses to clear the entire page	`pages:write`
`page.reorder_blocks`	Rearrange the draft's blocks without editing their content — every block id listed exactly once	`pages:write`
`page.publish`	Publish the draft to the live public page. Two-step: the first call returns a preview plus a `confirmToken`, the second commits	`publish`
`page.schedule_publish`	Schedule the page to publish at a future time. Two-step confirm; the commit call must repeat the same `startsAt`	`publish`
`page.cancel_scheduled_publish`	Cancel the page's pending scheduled publish; the draft and the live page stay as they are	`publish`

page.publish and page.schedule_publish are the dangerous set: they change what real visitors see, so they need the publish scope AND a per-workspace "dangerous operations" toggle that ships OFF. page.cancel_scheduled_publish only removes a pending schedule, so it needs the publish scope but not the toggle.

Scopes

You grant exactly what an app asked for. These are the descriptions shown on the consent screen:

Scope	What it grants
`pages:read`	See your bio pages, blocks, and themes
`pages:write`	Create and edit drafts of your bio pages
`analytics:read`	See your page views, clicks, and traffic sources
`contacts:read`	See your captured contacts and leads
`files:read`	See your uploaded files and media
`publish`	Publish changes to your live pages

An agent calling a tool outside its granted scopes gets a structured SCOPE_MISSING denial — never silent partial access.

Safety rails

Consent screen. You approve exactly which scopes an app gets when it connects, each listed in plain language.
Block edits wait for a publish. Block writes (page.add_block, page.remove_block, page.reorder_blocks, and block patches in page.update_draft) only touch the draft and reach your live page only through a publish. A title, description, or theme change through page.update_draft applies to your live page without waiting for a publish.
Publishing is off by default per workspace, and even after you enable it, every publish is a two-step flow: the first call returns a preview plus a short-lived confirm token (valid 10 minutes), and nothing commits until a second call with that token.
Optimistic concurrency. Every write tool requires the expectedUpdatedAt you read from page.get, so a stale draft is refused rather than clobbered. Writes also accept an optional idempotencyKey so a retried call cannot run twice.
Audit log. Every tool call is logged. Settings, under Connected AI apps, shows each app's call count and when it last ran.
Revocation. Revoke any connected app from Settings, under Connected AI apps. Its next request to your workspace is refused, even if the access token it holds hasn't expired, and its refresh token is revoked, so it can never obtain new access.

Structured denials

Every refusal is a typed code an agent can act on, never a mystery error or a silent no-op:

Code	What it means
`SCOPE_MISSING`	The tool needs a scope this connection was never granted. Reconnect and approve it.
`DANGEROUS_OPS_DISABLED`	A publish-class tool while the workspace toggle is off. The denial carries a deep link to that setting.
`QUOTA_EXCEEDED`	The call would pass your plan's limits.
`STALE_SNAPSHOT`	The draft changed between the preview call and the commit call, so the commit was refused.
`CONFIRM_TOKEN_INVALID`	The `confirmToken` was forged, expired, or minted for a different operation.

OAuth discovery

Discovery follows RFC 8414 (authorization server metadata) and RFC 9728 (protected resource metadata); clients register themselves through unauthenticated dynamic client registration per RFC 7591. The documents are served at:

https://app.getbioflow.com/.well-known/oauth-authorization-server
https://app.getbioflow.com/.well-known/oauth-protected-resource

Connecting AI assistants (MCP)

On this page