# MCP clients

MapleID's MCP server is at `https://mapleid.ca/mcp`. It uses streamable HTTP and the protocol version 2025-11-25. A request without a token gets 401 with a link to `/.well-known/oauth-protected-resource/mcp`, which names MapleID as the authorization server.

MapleID has no dynamic client registration. So your MCP client must let you enter a client ID, and a secret for a confidential client. Create the client first, on [Agent clients](/developers/agent-clients). Ask for `openid`, `offline_access`, `mapleid.agent.mcp` and the scopes of the tools that you use.

If your client can ask for fewer scopes at refresh, do it for a call to one app. A token carries every resource of its scopes in aud.

## Claude Code

**Not tested.** Nobody ran this recipe against MapleID. Check each step before you rely on it.

| Setting | Value |
|---|---|
| Client kind | Public local web app |
| Redirect URI | `http://localhost:<port>/callback` |
| Callback port | The port that you give with `--callback-port`. Use the same port in the redirect URI. |

1. Create a public local web app client with the redirect URI `http://localhost:8765/callback`.
2. Run `claude mcp add --transport http --client-id <client id> --callback-port 8765 mapleid https://mapleid.ca/mcp`.
3. In Claude Code, run `/mcp` and choose mapleid. Sign in on the page that opens.

## Cursor

**Not tested.** Nobody ran this recipe against MapleID. Check each step before you rely on it.

| Setting | Value |
|---|---|
| Client kind | Public local web app or public native app, if Cursor lets you enter a client ID and a loopback callback |
| Redirect URI | The callback that Cursor uses. MapleID accepts only `http://127.0.0.1`, `http://[::1]` or an exact `http://localhost:<port>` for a public client. |
| Callback port | A fixed port, if Cursor uses a loopback callback. |

1. Find the OAuth callback of your Cursor version.
2. If it is a loopback URI, create a client of the matching kind with that URI.
3. Add the server `https://mapleid.ca/mcp` with the client ID. If Cursor uses a custom scheme callback, Cursor cannot sign in to MapleID today.

## Claude Desktop

**Not tested.** Nobody ran this recipe against MapleID. Check each step before you rely on it.

| Setting | Value |
|---|---|
| Client kind | Confidential web app |
| Redirect URI | `https://claude.ai/api/mcp/auth_callback` |
| Callback port | None. The callback is an https URI. |

1. Create a confidential web app client with the redirect URI `https://claude.ai/api/mcp/auth_callback`.
2. In Settings, Connectors, add a custom connector with the URL `https://mapleid.ca/mcp`.
3. In the advanced settings, enter the client ID and the secret.
4. Connect, and sign in on the page that opens.

## A web connector

**Not tested.** Nobody ran this recipe against MapleID. Check each step before you rely on it.

| Setting | Value |
|---|---|
| Client kind | Confidential web app |
| Redirect URI | The https callback of the service that hosts the connector |
| Callback port | None. The callback is an https URI. |

1. Find the OAuth callback of the service.
2. Create a confidential web app client with that exact URI.
3. Enter the server URL `https://mapleid.ca/mcp`, the client ID and the secret in the service.

## The Go MCP SDK (go-sdk)

**Not tested.** Nobody ran this recipe against MapleID. Check each step before you rely on it.

| Setting | Value |
|---|---|
| Client kind | Public native app |
| Redirect URI | `http://127.0.0.1:<port>/callback` |
| Callback port | Any free port. MapleID accepts any port on 127.0.0.1 for a native client. A fixed port makes the redirect URI simple to read. |

1. Create a public native app client with the redirect URI `http://127.0.0.1/callback`.
2. Use `golang.org/x/oauth2` with PKCE, the endpoints `https://mapleid.ca/oauth/v2/authorize` and `https://mapleid.ca/oauth/v2/token`, and a listener on `127.0.0.1`.
3. Give `mcp.StreamableClientTransport` an `http.Client` from `oauth2.Config.Client`, with the endpoint `https://mapleid.ca/mcp`.
4. Call `ListTools`, then `get_organization`.