> MCP server.

Parameters use camelCase, but snake_case aliases are also accepted — e.g. mdflow_get_document takes both documentId and document_id.

Claude and the ChatGPT app connect to the hosted server with no token to copy — you sign in and MDflow issues the access token for you.

ChatGPT adds https://mdflow.cz/api/mcp as a custom connector:

1. 1.In ChatGPT, open the connector settings and add a custom connector.
2. 2.Paste https://mdflow.cz/api/mcp as the URL and click connect.
3. 3.MDflow's sign-in and consent screen opens. Approve it, and the connector is ready — the mdflow tools appear in the client.

Behind the scenes the client discovers the authorization server from /.well-known/oauth-protected-resource (RFC 9728), registers itself (Dynamic Client Registration), and receives an OAuth access token — nothing is pasted by hand. OAuth needs an MDflow Pro account, the same as a Personal Access Token (ChatGPT's sign-in is in beta). Prefer a token, or connecting a client that sends its own Authorization header? Use the Personal Access Token setup below.

Clients that send their own Authorization header — Cursor and the OpenAI Responses API — authenticate the hosted server at https://mdflow.cz/api/mcp with a Personal Access Token instead of the OAuth sign-in above. For Claude Code and Claude Desktop the token configs below are the legacy path; the Claude connector needs no token. It runs over the MCP Streamable HTTP transport and is always up to date. Create a Personal Access Token first; it starts with mdf_.

claude mcp add --transport http mdflow https://mdflow.cz/api/mcp \
  --header "Authorization: Bearer mdf_your_token_here"

{
  "mcpServers": {
    "mdflow": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "https://mdflow.cz/api/mcp",
        "--header",
        "Authorization:Bearer mdf_your_token_here"
      ]
    }
  }
}

{
  "mcpServers": {
    "mdflow": {
      "url": "https://mdflow.cz/api/mcp",
      "headers": { "Authorization": "Bearer mdf_your_token_here" }
    }
  }
}

{
  "model": "gpt-5.2",
  "tools": [
    {
      "type": "mcp",
      "server_label": "mdflow",
      "server_url": "https://mdflow.cz/api/mcp",
      "headers": { "Authorization": "Bearer mdf_your_token_here" }
    }
  ],
  "input": "Get information about onboarding from mdflow."
}

For agents: the server is stateless — no session IDs, plain JSON responses, one POST per JSON-RPC message. Rate limit is 60 requests per minute per token; 429 responses carry Retry-After in seconds. The same API is also available as REST — see the API reference and OpenAPI spec.

Prefer a process on your own machine? The local stdio server exposes the same tools and talks to the same API.

• ›Node.js 18+ — the server relies on the built-in fetch.
• ›A terminal with npm.
• ›An MDflow Personal Access Token (created in step 3).

mdflow_get_context is the main agent-facing tool. Given a topic it:

1. 1.Lists folders and documents.
2. 2.Scores folder descriptions highest — they define the intended context for the files they contain.
3. 3.Scores folder names and document titles.
4. 4.Fetches only the selected document bodies.
5. 5.Returns a readable markdown context block plus structured data.

Defaults to 5 documents, each truncated to 12,000 characters. Callers can request up to 10 documents, or between 500 and 50,000 characters per document.

An MDflow Team account is a shared tenant with its own members, roles, workspaces, folders, and markdown documents, separate from any member's personal workspaces. It has its own hosted MCP server at https://mdflow.cz/api/team/mcp — the same Streamable HTTP transport as the personal server, stateless, one POST per JSON-RPC message — with 16 mdflow_team_* tools. Personal tokens are rejected here, and Team tokens are rejected on the personal server.

Team access tokens

Any member creates a named token on the Team's API Access page (/teams/<accountId>/api-access). It starts with mdt_ and is shown once. A token is bound to one Team account, granted only the workspaces picked when it was created, and capped at read-only or read-and-write. Every request re-checks the creator's live membership, role, and per-workspace permission and the Team account's state: a read cap can never write, a write token writes only where its creator currently has write access and the account is active, and removing a member deletes their tokens. Eligibility comes from the Team seat — no MDflow Pro is needed. Every write is attributed to the creator in the Team audit feed.

What it exposes

Same conventions as the personal tools: camelCase parameters with snake_case aliases, documents up to 500 KiB, folder descriptions up to 5000 characters, automatic numeric suffixes for duplicate names, and mdflow_team_get_context defaults of 5 documents at 12,000 characters each. Documents can live at a workspace root (folderId null), and creating a top-level folder or root document requires an explicit workspaceId. There is no sharing tool set — Team sharing is managed in the app.

Connect a client

The Team server accepts only Team access tokens today, so it works with clients that send their own Authorization header — Claude Code, Cursor, Codex, the OpenAI Responses API, MCP SDK clients, and Claude Desktop through mcp-remote. The MDflow connector in Claude's directory and the ChatGPT connector reach personal workspaces only; per-user OAuth for Team workspaces is a planned later phase.

claude mcp add --transport http mdflow-team https://mdflow.cz/api/team/mcp \
  --header "Authorization: Bearer mdt_your_team_token"

{
  "mcpServers": {
    "mdflow-team": {
      "url": "https://mdflow.cz/api/team/mcp",
      "headers": { "Authorization": "Bearer mdt_your_team_token" }
    }
  }
}

{
  "mcpServers": {
    "mdflow-team": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "https://mdflow.cz/api/team/mcp",
        "--header",
        "Authorization:Bearer mdt_your_team_token"
      ]
    }
  }
}

{
  "model": "gpt-5.2",
  "tools": [
    {
      "type": "mcp",
      "server_label": "mdflow_team",
      "server_url": "https://mdflow.cz/api/team/mcp",
      "headers": { "Authorization": "Bearer mdt_your_team_token" }
    }
  ],
  "input": "Summarize our incident playbooks from the mdflow team workspace."
}

For agents: rate limit is 60 requests per minute per token, with Retry-After on 429. A 401 means the token is invalid or revoked — tokens also stop working when their creator leaves the team. A 403 means the operation exceeds the token's effective access: the token or the creator's workspace permission is read-only, or the Team account is not active. There is no local stdio variant of the Team server. The tools are HTTP clients over the Team REST API, which is described in the same OpenAPI spec.

Claude connects through the MDflow connector in its Connectors Directory, and that one connection also serves the Claude desktop and mobile apps and Claude Code. The ChatGPT app connects through its custom-connector picker. Both use an OAuth sign-in — no token (see above). Clients that attach their own Authorization header — Cursor, VS Code, the OpenAI Responses API, and MCP SDK clients — connect with a Personal Access Token, as do the legacy Claude Code and Claude Desktop configs. Claude Desktop's config can reach it through the mcp-remote stdio bridge, which requires Node.js. The local server works with clients that can launch a process — Claude Desktop, Codex, Cursor, and similar.