Connect Smplify MCP
OAuth 2.1 is required for the hosted Smplify MCP service. Add the hosted endpoint without an Authorization header; your MCP client discovers Smplify authorization, opens sign-in, and stores its own audience-bound MCP credentials.
Connect with OAuth 2.1
Add https://mcp.smplify.com/mcp as a remote Streamable HTTP server. Do not add a bearer header, API key, or token to the client configuration. The client discovers authorization from the protected resource, redirects to https://auth.smplify.com, and receives a Smplify-issued MCP token.
Current MCP clients can identify themselves with a Client ID Metadata Document; Dynamic Client Registration remains available as a compatibility fallback. Both paths require PKCE S256 and bind authorization and token exchange to the exact https://mcp.smplify.com/mcp resource.
The OAuth service validates your Smplify sign-in and keeps any upstream Smplify API credential server-side in a private connector vault. It never returns that upstream credential to the MCP client. The vault uses AWS KMS-backed envelope encryption in production, stays on the internal Railway network, and feeds an upstream session lifecycle manager so expired connections fail closed.
After you connect on claude.ai, ChatGPT, or desktop, that same connection can be reused on supported mobile clients. If the upstream Smplify session is nearing expiry, Smplify recommends reconnect before the encrypted bridge expires.
Connector URL: https://mcp.smplify.com/mcp OAuth issuer: https://auth.smplify.com Protocol: MCP 2026-07-28 Authentication: OAuth 2.1 + PKCE S256
Local stdio and private self-hosting
This separate workflow is only for a process you run and secure yourself. It never authenticates to the hosted Smplify MCP endpoint.
Local stdio and private self-hosting
This separate workflow is only for a process you run and secure yourself. It never authenticates to the hosted Smplify MCP endpoint.
Keep local credentials local
A local stdio server or independently secured self-hosted deployment can read SMPLIFY_API_KEY from that process environment. Follow the local run guide and your organization’s secret-management policy.
Never attach that upstream Smplify credential to https://mcp.smplify.com/mcp. The hosted endpoint accepts only audience-bound tokens obtained through its OAuth discovery flow.
See the hosted connector architecture
Expand to review the end-to-end service flow behind the OAuth path, private connector vault, KMS-backed storage, and tenant-aware execution model.
See the hosted connector architecture
Expand to review the end-to-end service flow behind the OAuth path, private connector vault, KMS-backed storage, and tenant-aware execution model.
Hosted connector architecture
The hosted OAuth path is now a six-step service flow rather than a raw token paste.
1. Client starts OAuth
Claude or ChatGPT points at https://mcp.smplify.com/mcp and discovers the MCP-domain OAuth metadata.
2. Smplify sign-in
auth.smplify.com handles OAuth sign-in and issues a Smplify-issued MCP token for the client.
3. Private token bridge
If upstream Smplify API access still needs a bearer token, the bridge is stored only in the private connector vault.
4. KMS-backed storage
The connector vault uses AWS KMS-backed envelope encryption in production and is not exposed as a public integration surface.
5. Session lifecycle checks
The lifecycle manager tracks ACTIVE, EXPIRING_SOON, RECONNECT_REQUIRED, and REVOKED before MCP refreshes or upstream calls continue.
6. Tenant-aware execution
The MCP gateway validates the Smplify-issued token, resolves the vault connection over the internal path, and requires a signed active-tenant binding or an explicit allow-listed selector for writes.
Choose your MCP client
These configurations contain only the canonical hosted URL. On first connection, the client follows MCP authorization discovery and opens the Smplify login. No upstream API credential is copied into these snippets.
Using management actions: Allow Smplify write tools in your client or workspace. If an older connection cannot create or apply policies, remove and reconnect it so OAuth can grant mcp:write. A successful intent-based change shows Smplify's preview and Approval Gate instead of asking the client to build separate platform policies.
Letters, numbers, underscores, and hyphens are supported.
This adds Smplify as a user-scoped remote MCP server. Claude Code starts OAuth automatically when it first connects.
The first command registers the canonical OAuth resource and selects automatic client registration. The second opens a fresh OAuth login whenever you need to reconnect.
Add this to .cursor/mcp.json for one project or ~/.cursor/mcp.json for every project. Leave headers unset so Cursor can run OAuth discovery.
Open MCP: Open User Configuration for a global install, or create .vscode/mcp.json in a workspace. VS Code discovers OAuth when the server starts.
In Claude settings, open Connectors, choose Add custom connector, and use this URL. Claude follows the hosted OAuth flow without a custom header.
Create a remote MCP app using the URL below and choose OAuth. ChatGPT discovers the authorization server and completes PKCE without a manually supplied token.