Connect AI with MCP

Activation connection: six read tools

The connection is bound to its authorizing member and workspace. Every call checks current membership, role, subscription, scopes and shared rate limits through WinLayer’s capability broker. A viewer cannot access tools requiring a business-development or leadership role. Reads stop when the trial expires. Retrieved documents remain untrusted evidence, never instructions.

Connect Codex

1. Copy the endpoint and temporary credential from Connect AI.
2. Store the credential in the secure environment variable WINLAYER_MCP_TOKEN.
3. Add this server configuration using your copied endpoint, then restart the client connection.

[mcp_servers.winlayer]
url = "https://YOUR_API_ORIGIN/api/v1/mcp"
bearer_token_env_var = "WINLAYER_MCP_TOKEN"
enabled_tools = ["get_company_brain", "list_matching_opportunities", "get_opportunity_evidence", "list_recompete_signals", "get_morning_brief", "list_watchlists"]
tool_timeout_sec = 60

Ask: “Show my company’s strongest opportunity, cite its sources, and explain eligibility gaps.” No key belongs in the prompt or configuration file. When the credential expires, authorize a replacement in WinLayer and reconnect. This uses explicit short-lived API-key consent; it does not claim to be OAuth. See the official Codex MCP configuration.

Capture, tasks, outreach and bids are unavailable through this connection. Prepare and approve a capture handoff inside WinLayer. Trial activation never authorizes external actions.

Existing developer API connections

Existing developer keys retain their established API catalog and plan controls. The following reference applies to those credentials. The new activation connection always uses the six-tool read allowlist above.

What this is

WinLayer's MCP server is a real adapter over the same public API, grounded agents, tenant checks, plan limits, and approval services used by the web, desktop, CLI, and mobile clients. It does not create a second data store or bypass product governance.

• The API key fixes the tenant, environment, owner, and available scopes before any tool is listed.
• Each MCP request is rate limited and metered under that API key.
• Sandbox keys expose deterministic synthetic read tools and never advertise live AI or action tools.
• Live AI runs still enforce subscription capability, usage allowance, hourly cost cap, evidence grounding, and the workspace kill switch.
• Action decisions still require a live actions:write key and the key owner's current workspace role.

Connect in three steps

1. Create a dedicated key under Developer Portal → Credentials. Choose only the scopes that client needs.
2. Add a remote MCP server in the AI client, choose HTTP or Streamable HTTP, and paste the endpoint shown in the portal.
3. Configure Authorization: Bearer <key> using the client's credential store. Never commit the plaintext key.

{
  "mcpServers": {
    "winlayer": {
      "type": "http",
      "url": "https://YOUR_API_ORIGIN/api/v1/mcp",
      "headers": {
        "Authorization": "Bearer ${WINLAYER_API_KEY}"
      }
    }
  }
}

Configuration names differ between clients. The endpoint, Streamable HTTP transport, and bearer header are the portable parts.

Tool catalog

Protocol check

This request verifies authentication and the MCP handshake without running a business tool:

curl -sS "https://YOUR_API_ORIGIN/api/v1/mcp" \
  -H "Authorization: Bearer $WINLAYER_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  --data '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "initialize",
    "params": {
      "protocolVersion": "2025-11-25",
      "capabilities": {},
      "clientInfo": { "name": "connection-check", "version": "1.0.0" }
    }
  }'

Security boundaries

• Use one key per AI client so usage, rotation, and revocation stay attributable.
• Start with a sandbox key to inspect schemas and output without exposing production workspace data.
• Do not grant actions:write to a client that only needs research or Q&A.
• Revoking the key removes the MCP client's access immediately; there is no separate MCP session credential.
• A client can request only tools that appear in its scoped catalog. Server callbacks enforce the same scope again before calling WinLayer services.

Continue with API authentication and scopes, security and tenancy, and roles and permissions.