MCP server

Maxint Work is a remote MCP server (Model Context Protocol). Any MCP client that supports remote servers and OAuth can connect to it: Claude, ChatGPT, Claude Code, MCP Inspector or your own agent. This page is for developers. To connect Claude or ChatGPT, follow their pages instead.

A connection acts as the person who approved it, in one workspace, with their role. It never sees more than they do, and its changes show in the app under their name.

The server URL

URL	https://api-work.maxint.com/mcp
Transport	Streamable HTTP, stateless. Every request is a POST with a JSON-RPC message; responses are JSON.
Auth	Authorization: Bearer <access token>, from the OAuth flow below

The app shows the URL for your deployment in Settings › Integrations: click Connect on the Claude or ChatGPT card and copy Connector URL. Use that one when your Maxint Work runs at another address.

A request without a valid token gets 401 with WWW-Authenticate: Bearer resource_metadata="<url>", which points the client at the sign-in metadata.

Sign-in (OAuth 2.1)

The MCP server is its own OAuth 2.1 authorization server. A client discovers it, registers, and sends the person to a consent page in Maxint Work, where they sign in, choose the workspace and click Allow.

Discovery

Path	What it returns
/.well-known/oauth-protected-resource (also …/oauth-protected-resource/mcp)	Protected resource metadata (RFC 9728): the resource (the server URL), the authorization server and the scopes
/.well-known/oauth-authorization-server	Authorization server metadata (RFC 8414): the endpoints below, S256 as the only PKCE method, and client_id_metadata_document_supported

Both paths are on the server’s host, for example https://api-work.maxint.com/.well-known/oauth-authorization-server.

Registering a client

A client identifies itself in one of two ways:

• Dynamic client registration (RFC 7591): POST /oauth/register with client_name and redirect_uris. Public clients send token_endpoint_auth_method: none and get no secret. Without it, the client is confidential (client_secret_basic, or client_secret_post if you ask for it) and gets a client_secret.
• Client ID metadata document: use an https URL with a path as the client_id. The server fetches it (no redirects, at most 5 KB, 5 seconds). The document must name that same URL as its client_id, list the redirect URI and use token_endpoint_auth_method: none. It is read again after an hour.

Redirect URIs must use https. http is allowed only on a loopback address (such as 127.0.0.1 or ::1), on any port, for desktop and command-line clients. An app’s own URL scheme is allowed too. Fragments are not.

The consent page shows the client’s name and the host it sends the person back to. The name is the client’s own claim; the host is checked against the registered redirect URI.

Authorizing

1. Send the person’s browser to GET /oauth/authorize with response_type=code, client_id, redirect_uri, state, scope, code_challenge and code_challenge_method=S256. PKCE is required. resource is optional; if you send it, it must be the server URL.
2. The server sends the browser on to the Maxint Work consent page. The person signs in if needed, chooses a workspace, may tick Read-only access, and clicks Allow or Deny.
3. The browser returns to your redirect_uri with code, state and iss (RFC 9207), or with error=access_denied.
4. Exchange the code at POST /oauth/token with grant_type=authorization_code, code, redirect_uri, client_id and code_verifier. You get an access token and a refresh token.
5. When the access token expires, call POST /oauth/token with grant_type=refresh_token. Each refresh returns a new refresh token; use the new one from then on.

Scopes

Scope	Gives
work	Every tool: reading, creating and changing. The person can still choose read-only on the consent page.
work:read	Only the tools that read and search. The consent page starts with Read-only access ticked.

A client that asks for work:read alone gets a read-only connection. Any other request gets work, unless the person chooses read-only.

Lifetimes

	Lasts	Notes
Consent request	10 minutes	Answered once. After that the page says This request has expired.
Authorization code	60 seconds	Used once. Using it twice ends the connection.
Access token	1 hour	Opaque, starts with mxw_at_.
Refresh token	90 days	Rotated on every use. Presenting an old one again (after a one-minute grace for retries) ends the connection.
Connection	Up to 1 year	Then the person connects again.

Tools

Tools are grouped below. Reads only reads; Changes creates or changes something. Every tool carries MCP annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint: false), so clients can ask before changes. Results are structured and include a url that opens the item in the app. A read-only connection lists only the tools marked Reads. Call tools/list for the exact set your connection has.

Workspace, people and search

Tool	Does
get_context	Who the connection acts as (name, role), the workspace, whether it is read-only, and today’s date	Reads
list_members	The workspace’s members, people and AI Workers, with their roles	Reads
find_people	Persons and organizations in Contacts whose name contains the text	Reads
search	Searches everything the person can see (issues, documents, cards, messages and more), best matches first	Reads
fetch	Reads one search result in full: an issue, a document or a card	Reads

search and fetch follow the shape ChatGPT expects of a connector, so ChatGPT’s deep research and company knowledge can use Maxint Work as a source.

Tracker

Tool	Does
list_projects	The projects the person can see	Reads
find_issues	Issues by project, title words, assignee, status or parent, most recently changed first	Reads
get_issue	One issue in full: description, status, assignee, labels, sub-issues and latest comments	Reads
create_issue	Creates an issue or sub-issue with description, assignee, priority, status, due date and labels	Changes
update_issue	Changes an issue’s title, status, assignee, priority, due date or description	Changes
comment_on_issue	Adds a comment to an issue	Changes
list_milestones	A project’s milestones	Reads
create_milestone	Creates a milestone in a project	Changes
set_issue_milestone	Puts an issue in a milestone, or takes it out	Changes
add_label	Puts a label on an issue, creating the label if needed	Changes
log_time	Records time spent on an issue	Changes

Documents

Tool	Does
list_teamspaces	The teamspaces the person can see	Reads
create_teamspace	Creates a teamspace; the person owns it	Changes
list_documents	Documents, newest first, by teamspace or title words	Reads
read_document	A document’s content as Markdown	Reads
create_document	Creates a document in a teamspace, with Markdown content	Changes
append_to_document	Adds Markdown at the end of a document	Changes
replace_document	Replaces a document’s whole content (marked destructive)	Changes
move_document	Moves a document, with the documents under it, to another parent or teamspace	Changes

Cards

Tool	Does
list_card_types	The card types in the workspace	Reads
find_cards	Cards by type or title words	Reads
get_card	One card in full	Reads
create_card	Creates a card	Changes
update_card	Changes a card	Changes

Chat

Tool	Does
list_channels	The channels the person can see	Reads
read_channel	A channel’s latest messages	Reads
post_message	Posts a message in a channel	Changes
create_channel	Creates a channel	Changes

Calendar and planner

Tool	Does
calendar_events	The person’s events in a date range	Reads
find_free_time	Free slots in the person’s calendar	Reads
create_event	Creates an event	Changes
cancel_event	Cancels an event	Changes
create_todo	Adds a to-do to the person’s planner	Changes
plan_time	Plans time for a to-do or issue in the planner	Changes

Processes, time off and contacts

Tool	Does
list_processes	The processes cards go through, with their states	Reads
start_process	Starts a process on a card	Changes
my_process_tasks	The person’s process tasks: action items and approvals	Reads
complete_process_task	Closes a process task: fills in an action item, or approves or rejects with a reason	Changes
list_time_off_types	The kinds of time off people can request (vacation, sick, remote work…)	Reads
request_time_off	Files a time-off request for the person, or for a member of a department they lead	Changes
create_contact	Adds a person to Contacts, optionally in an organization	Changes
create_organization	Adds an organization to Contacts	Changes

Test management and drive

Tool	Does
list_test_cases	Test cases by suite or name words, or the results of a test run	Reads
create_test_case	Writes a test case in a suite of a test project	Changes
start_test_run	Starts a test run with the cases named, a suite or the whole project	Changes
set_test_result	Records how a test case went in a run	Changes
list_files	The drives, or the folders and files in one; finds them by name	Reads
create_folder	Creates a folder in a drive	Changes
save_file	Saves text as a Markdown or plain-text file in a drive, up to 1 MB	Changes

When a tool fails for a reason the assistant can fix (an unknown project, a missing field), the error says what to do, so the assistant can try again.

Connect from other clients

MCP Inspector

MCP Inspector is a quick way to see the tools and try them.

1. Run npx @modelcontextprotocol/inspector. It opens in your browser.
2. Choose Streamable HTTP as the transport and enter the server URL.
3. Click Connect. The Inspector registers itself and opens the Maxint Work consent page: choose the workspace and click Allow.
4. Open Tools and click List Tools. Try get_context first.

Claude Code

claude mcp add --transport http maxint-work https://api-work.maxint.com/mcp

Then type /mcp in Claude Code, choose maxint-work and sign in. See Claude.

Your own client

Use an MCP SDK with OAuth support and point it at the server URL. On the first 401 it reads the metadata, registers (or uses a client ID metadata document), runs the authorization code flow with PKCE and keeps the tokens. Store the refresh token safely and replace it after every refresh.

If you only need scripts, not an assistant, the REST API with an API token may be simpler.

Revoke access

A connection ends when any of these happens:

• The person clicks Disconnect in Settings › Integrations (Configure on the Claude or ChatGPT card).
• The person revokes the connection’s token in Settings › API Tokens. Each connection is listed there under the client’s name followed by “connector”, for example Claude connector.
• The client calls POST /oauth/revoke (RFC 7009) with the access or refresh token. Revoking either ends the whole connection.
• The person loses access to the workspace, or the connection reaches its one-year limit.

After that, every request with its tokens gets 401, and the client has to send the person through sign-in again.

Caution

Treat access and refresh tokens like passwords. Never log them or put them in code others can read. The server keeps only hashes of codes and tokens.

Note

The Claude and ChatGPT cards in Settings › Integrations list connections whose redirect goes to Claude or ChatGPT. Connections of other clients show only in Settings › API Tokens.