Connect MCP clients

An MCP client reaches your organisation's MCP servers through one CoreValue URL. It proves who it is in one of two ways:

• An API key in a header. For clients that let you set a header, such as Claude Code and Cursor, and for your own agents.
• Signing in. For clients that connect with OAuth and cannot send a header you choose, such as claude.ai. A member signs in to CoreValue from the client and approves the connection. No key is pasted anywhere.

Both reach the same servers and tools, and both are logged as tool calls. The difference is who a call is attributed to: the key and its team, or the member who signed in.

Which URL to use

Every server registered on Gateway › MCP servers has a Server ID. Clients can connect to:

• https://gateway.corevalue.dev/mcp — every enabled server in your organisation behind one URL. Tool names are prefixed with the server ID, as <server-id>__<tool>.
• https://gateway.corevalue.dev/mcp/<server-id> — one server, with its tool names unchanged. Use this when a client needs to receive requests from the server itself, such as sampling or elicitation, which the combined URL does not relay.

Use the URL exactly as written, with no trailing slash.

Connect with an API key

Create a CoreValue API key (see API keys), then add the URL and the key to your client's MCP configuration. Send the key as Authorization: Bearer <key>. A key in the URL (?key=) is refused.

For Claude Code:

claude mcp add --transport http corevalue \
  https://gateway.corevalue.dev/mcp \
  --header "Authorization: Bearer $COVA_API_KEY"

Cursor, and any other client that accepts a remote MCP server with a header, needs the same two things: the URL and the Authorization header. Restart or reconnect the client, then open its MCP tools list to confirm the tools are there.

Calls made with a key are attributed to the key and its team. To attribute them to an end user or a customer as well, send Cova-User-Id and Cova-Customer-Id, as on the LLM gateway.

Connect by signing in

Turn on client sign-in

Signing in is off until an owner or admin turns it on for the organisation:

1. Go to Gateway › MCP servers.
2. Under Client sign-in, turn on Let members connect MCP clients by signing in.

From then on, any member of the organisation can connect a client. The setting changes nothing about how the gateway reaches the servers themselves; for servers that need their own sign-in, see Servers that need their own sign-in.

Turning it off disconnects every client connected to the organisation at once, and members cannot connect new ones until it is turned back on.

Add the URL to the client

In claude.ai, add the URL as a custom connector, for example https://gateway.corevalue.dev/mcp. When you connect it, claude.ai sends you to CoreValue to sign in.

A connection works on the URL it was made for and no other. To use a second URL, such as a single server's, connect it separately.

Approve the connection

After you sign in, CoreValue shows a consent screen, Connect app to CoreValue, before anything is shared. It shows:

• The app. Its name, and how it was identified. An app that publishes a metadata document is shown with the host that serves it. An app that registered itself chose its own name, and the screen says the name is provided by the app, not verified by CoreValue.
• Organisation. Which organisation the connection works in. Only organisations you belong to that have the MCP gateway and have client sign-in turned on are offered.
• Team (optional). Tool calls from the connection are attributed to this team. You can only pick teams you belong to.
• Where you will be sent next. The host the app receives the answer at. When that is an app on your own computer, the screen says so: continue only if you started the connection from an app you trust.

Allow completes the connection. Deny returns you to the app with nothing shared.

What the client can then do

The client uses the MCP gateway as you. It can list and call the tools your organisation makes available through the gateway, subject to the same access rules as any other caller, matched to you and the team you picked.

• Every tool call is recorded under your name. On Requests › MCP, a call made this way reads via the app and your email, for example via Claude · ana@example.com.
• The client's access lasts an hour at a time. A client that asks for offline access, as claude.ai does, renews it in the background, so you do not sign in again every hour. After 30 days without use, or 90 days after you connected, you sign in again.
• The sign-in works on the MCP gateway only. It does not work on the LLM gateway or on agent routes, which take an API key.

Connected clients

Gateway › MCP servers › Connected clients lists the apps you have signed in, under Your connections: the app, the organisation, the team, when it was connected and when it was last used.

• Revoke disconnects an app at once. Tool calls it already made stay in your logs. To use it again, connect it again.
• Owners and admins also see All connections in organisation, with the member each connection belongs to, and can revoke any of them.
• A connection whose member has left its team keeps working; it shows team removed, and its calls are attributed to no team.
• A member who leaves the organisation loses their connections to it.

Troubleshooting

"No organisation can accept this connection." None of your organisations can take the connection: either client sign-in is off, or the organisation does not have the MCP gateway, or you are not a member of the organisation you expected. Ask an owner or admin to turn on Client sign-in in Gateway › MCP servers, or to invite you.

"This connection request can't be completed." The app made a request CoreValue cannot accept, and the page says why in brackets — for example, the app is not one CoreValue knows, or its return address is not one it registered. Nothing was shared. Return to the app and connect again; if it keeps happening, remove the connector from the app and add it again.

The client connected, but every call fails. The connection may have been revoked — by you, an owner or admin, or by client sign-in being turned off. Check Connected clients, then reconnect from the client.

No tools appear. Check that the server is enabled on Gateway › MCP servers, that an access rule does not deny you its tools, and, for a key, that the key is active. A server where each member signs in shows only a <server-id>__connect tool until you connect your own account; see Servers that need their own sign-in.

Related

• How the MCP gateway works
• Servers that need their own sign-in
• Roles and permissions: who can turn on client sign-in and revoke other members' connections.