Connecting MCP Hosts

An MCP server you define in Twisp is reached from the tools your team already uses, such as Claude Code, Claude, and VS Code. You connect a host by adding the server's URL, and sign in as the Twisp user you are, on the same page and with the same MFA as the Twisp console. There are no tokens to copy and no credentials in configuration files.

Before you connect

Each MCP server has its own URL:

Copyhttps://api.<region>.<environment>.twisp.com/mcp/v1/<account_id>/<name>

<account_id> is the account the server is in, and <name> is the server's registry name.

Claude, Claude Code, and Codex need nothing but the URL. Other hosts connect with a client ID, which identifies the host to Twisp sign-in. Client IDs are public and are the same for everyone in an environment, one for each family of hosts:

Twisp provides the client IDs for your environment: ask Twisp support or your account team for them. In the steps below, <client-id> is the client ID for that host's family.

Sign-in uses the OAuth authorization code flow with PKCE, which Twisp sign-in requires and every supported host uses. A client ID is only for signing in to MCP servers: its tokens are not accepted by the GraphQL API or the Twisp console.

To use a server, your user needs permission to read the server's action and INVOKE on it, in an account your user belongs to.

The first time a host connects from a browser, Twisp asks whether to allow it, names the host, and says where you return after signing in. Your browser remembers your answer for 30 days. Twisp marks hosts it has not verified: allow one only if you are connecting it yourself, right now.

Claude Code

Add the server with its URL:

Copyclaude mcp add --transport http fraud-ops https://api.us-east-1.cloud.twisp.com/mcp/v1/<account_id>/fraud-ops

Then run /mcp in Claude Code and choose the server to sign in. Your browser opens on Twisp's sign-in page. Claude Code identifies itself to Twisp sign-in, and receives the sign-in on any free local port, so it needs no client ID or callback port.

A team can check the same server into a repository's .mcp.json. It holds no secret, and each person who uses it signs in as themselves:

Copy{
  "mcpServers": {
    "fraud-ops": {
      "type": "http",
      "url": "https://api.us-east-1.cloud.twisp.com/mcp/v1/<account_id>/fraud-ops"
    }
  }
}

Claude and Claude Desktop

1. In Settings, open Connectors and choose Add custom connector.
2. Enter the server's URL. Leave Advanced settings empty: Claude identifies itself to Twisp sign-in.
3. Choose Connect, allow Claude on Twisp's page, and sign in.

A connector added in Claude is also available in Claude Desktop and on mobile.

VS Code

Add the server to your workspace's .vscode/mcp.json, with the VS Code client ID:

Copy{
  "servers": {
    "fraud-ops": {
      "type": "http",
      "url": "https://api.us-east-1.cloud.twisp.com/mcp/v1/<account_id>/fraud-ops",
      "oauth": { "clientId": "<client-id>" }
    }
  }
}

When VS Code starts the server, it asks you to sign in. VS Code first tries to receive the sign-in on a local port, which Twisp sign-in does not accept, and the browser shows an error. Return to VS Code and choose to try a different way: VS Code signs you in through vscode.dev instead.

ChatGPT and other apps

Any MCP host that supports OAuth sign-in for remote servers connects with only the server's URL. The host registers itself with Twisp sign-in, or identifies itself with its own metadata, so it needs no client ID. Add the server's URL where the host adds remote MCP servers or connectors, and sign in when it asks. Twisp shows these hosts as not verified before you allow them.

After you connect

• Staying signed in. The host refreshes its access silently for up to 30 days, after which you sign in again. If your console session is still open, signing in again usually needs no input.
• One sign-in per server entry. A host keeps a sign-in for each server it is configured with, so connecting a second server is a second sign-in, usually without a prompt. The token is bound to the region's MCP endpoints: it is not valid at the GraphQL API or in another region.
• What you can do. Requests are yours: through a server you can do what your user can do in Twisp, bounded by the server's policies. A change to your permissions reaches the host within an hour, at its next refresh.
• What is recorded. Every request is recorded as an execution of the server, whose request names you as its subject and the host as its oauthClientId. An operator can close your session to stop your requests at once, without affecting anyone else.
• Signing out. Removing the server from the host discards the host's access. When a user is disabled, access a host already holds for them lasts at most an hour.

The local environment

The local environment requires no sign-in. A host connects to http://localhost:8080/mcp/v1/000000000000/<name> with no client ID.