MCP server

Auto Appy runs a Model Context Protocol server so AI assistants can read, build and run workflows for a signed-in person. For a non-technical setup guide, see Build with Claude and ChatGPT.

In the course

• SRClaude connected with read and build permissions only. Lesson 5: Build by talking to Claude →

Endpoint

URL	https://api.autoappy.com/mcp
Transport	Streamable HTTP, JSON-RPC over POST. Each request gets a single JSON response (no event stream, no session). GET and DELETE return 405.
Protocol versions	2026-07-28, 2025-11-25, 2025-06-18
Server	Auto Appy · version 1.0.0-beta
Instructions	Sent on initialize: a short playbook telling the assistant how Auto Appy workflows are built.

Authentication

OAuth (recommended)

Assistants that support MCP authorisation sign in by themselves:

• Discovery: /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server on api.autoappy.com. An unauthenticated call returns 401 with resource_metadata.
• Dynamic client registration at /mcp/oauth/register (public clients, no secret). Redirect URIs may be HTTPS, loopback HTTP on any port, or a private app scheme.
• PKCE with S256 is required. Token endpoint: /mcp/oauth/token (authorization code and refresh token grants).
• The person approves on Auto Appy’s Connect client to Auto Appy page, choosing scopes.

Token	Prefix	Lifetime
Access token	aa_mcp_	60 minutes
Refresh token	aa_mcpr_	90 days; both rotate on every refresh
Authorisation code	—	10 minutes, single use

Token (bearer)

For clients without OAuth, create a token and send it as a header.

1. Go to Settings → MCP connections and switch on Enable MCP access.

   Open MCP connectionsautoappy.com/settings/mcp

2. Click Create connection. Set a Connection name (one per assistant), Expires after (7 days, 30 days, 90 days or 1 year) and the Permissions.

3. Click Create token and copy it: “Copy this token now. It will not be shown again.”

4. Configure your client with the server URL and Authorization: Bearer aa_mcp_….

autoappy.com/settings/mcpSample data

×

Scopes

Scope	Consent label	Allows
workflows:read	Read workflows	Listing and reading workflows, run history, saved account names, trigger setup and mapping fields.
workflows:write	Build and edit workflows	Creating workflows, adding, configuring, connecting and deleting steps, choosing saved accounts, notes, and statuses.
workflows:execute	Run and do things for you	Testing steps, running workflows, one-off app actions, and running workflows you’ve exposed as tools.

The token only sees tools allowed by its scopes. It can never read credentials inside app connections.

Exposing workflows as tools

In Settings → MCP connections → Workflows, mark a workflow as Exposed to turn it into its own tool (run_<name>), and choose Runs immediately or Approval required. By default runs ask for your approval. Workflows with the MCP (Auto Appy) trigger are made to be started this way.

Approvals and activity

• Approvals lists run requests waiting for you. Approve or decline; requests expire after 60 minutes. Assistants check the outcome with autoappy_get_request.
• Activity logs every call: who, which tool, when, and the result.
• Connections lists each assistant (OAuth connections included) with Revoke.

autoappy.com/settings/mcpSample data

×

Limits

Limit	Value
Active connections per account	25
Requests	120 per minute per IP before sign-in, and 120 per minute per token
Request size / response size	256 KiB / 1 MiB
Approval wait	60 minutes

Signing out of Auto Appy doesn’t end MCP connections. Revoke them in Settings → MCP connections.

Raw example

A tools/list call with a token:

curl -X POST "https://api.autoappy.com/mcp" \
  -H "Authorization: Bearer $AUTOAPPY_MCP_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "MCP-Protocol-Version: 2025-11-25" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

MCP tools reference

Build with Claude and ChatGPT