MCP: Claude, ChatGPT, Cursor and other apps

MB Suite has a remote MCP server (Streamable HTTP) that exposes the same operations as the API, with the same permissions, quotas and audit trail. This is the URL you paste in the client:

https://mcp.mb-suite.com

Claude

1. 1In Claude, open Settings → Connectors → Add custom connector.
2. 2Paste the server URL and save.
3. 3Claude takes you to MB Suite to pick the organization and review the permissions; when you come back, it is connected.
4. 4Try “What can I do in MB Suite?”: the first tool is mb_context.

Claude connects with OAuth: you do not need to create an API key.

ChatGPT

1. 1In ChatGPT, open Settings → Apps & Connectors → Advanced settings and turn on developer mode (on business plans the administrator enables it).
2. 2Go back to Apps & Connectors, choose Create and paste the server URL as an MCP server.
3. 3ChatGPT takes you to MB Suite to authorize: review the organization and the permissions and confirm.
4. 4Turn the app on in the conversation and ask for something from the CRM.

Cursor

Cursor connects with an API key as the bearer. In Cursor Settings → Tools & MCP → New MCP Server, with this configuration and your API key:

{
  "mcpServers": {
    "mb-suite": {
      "url": "https://mcp.mb-suite.com",
      "headers": {
        "Authorization": "Bearer mbs_live_YOUR_API_KEY"
      }
    }
  }
}

VS Code

1. 1In VS Code, open the Command Palette and choose “MCP: Add Server”. You need GitHub Copilot.
2. 2Choose HTTP, paste the server URL and save it for your user or for the project (below, the .vscode/mcp.json configuration).
3. 3The first time, VS Code asks for permission to sign in and takes you to MB Suite to choose the organization and review the permissions.
4. 4In Copilot Chat, in Agent mode, try “What can I do in MB Suite?”.

{
  "servers": {
    "mb-suite": {
      "type": "http",
      "url": "https://mcp.mb-suite.com"
    }
  }
}

VS Code connects with OAuth: you do not need to create an API key.

Claude Code

1. 1In the terminal, add the server (with --scope user it is available in all your projects).
2. 2Open Claude Code, type /mcp and choose mb-suite to authenticate.
3. 3Claude Code opens MB Suite in the browser to choose the organization and review the permissions; when you come back, it is connected.

claude mcp add --transport http mb-suite https://mcp.mb-suite.com

Claude Code connects with OAuth: you do not need to create an API key.

Other apps

Any MCP-compatible app can connect. If it accepts remote servers with OAuth, paste the URL and it brings you to MB Suite to authorize. If it asks for an API key, use one as the bearer; in most apps the configuration looks like this:

{
  "mcpServers": {
    "mb-suite": {
      "url": "https://mcp.mb-suite.com",
      "headers": {
        "Authorization": "Bearer mbs_live_YOUR_API_KEY"
      }
    }
  }
}

If the app only accepts local servers, connect it through the mcp-remote bridge (it needs Node.js). The API key goes in env and the header without spaces, as the bridge requires:

{
  "mcpServers": {
    "mb-suite": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.mb-suite.com",
        "--header",
        "Authorization:${AUTH_HEADER}"
      ],
      "env": {
        "AUTH_HEADER": "Bearer mbs_live_YOUR_API_KEY"
      }
    }
  }
}

Your own client uses the same Authorization: Bearer mbs_live_…, or runs the OAuth flow with resource=https://mcp.mb-suite.com (see Authentication). Each call has up to 60 seconds.

The tools

Each credential chooses a surface: on the API key, “MCP tool mode” under Advanced; in OAuth, under Advanced on the consent screen.

• The list depends only on the credential: its scopes, the person's role and the organization's modules. What it cannot run does not show up; if it still asks for an operation that exists and lacks the scope, the deletion permission or the role, it gets a 403 that says what is missing (scope_insufficient, delete_not_allowed, role_required), not a 404. mb_search_operations lists in not_runnable the matching writes it cannot run, and in screen_only what is only done on the MB Suite screen (like API keys).
• Bulk, irreversible, what sends or changes something outside MB Suite, what has a separate cost and what always asks take dry_run and confirm_token: the agent first asks for the preview and then confirms with the token (10 minutes); without a token, 409 confirmation_required. A few ask only with certain data (needs_confirmation_when in mb_describe_operation). Through the MCP, dry_run works on any write: its needs_confirmation says whether running it needs the token. See Dry run and confirm_token.
• In mb_execute_operation, dry_run, confirm_token, audit_note, idempotency_key and org_id go next to id (inside input they also work; if they come in both places with different values, 400). In a typed tool they go with the rest of the arguments.
• If the credential reaches Accounts, the tools add org_id (optional) to target one.
• To retry a write safely (after a dropped connection or a timeout), send the same idempotency_key (up to 255 characters): for 24 hours, the same call returns the stored result (idempotent_replayed: true) instead of running again; with a different call it is 422 idempotency_key_reused, and while the first one runs, 409 idempotency_in_progress. It is the API's Idempotency-Key (Idempotency).
• A deletion that keeps a copy returns trash_item_id (in a batch, trash_item_ids) and trash_expires_at; platform.trash.restore restores it by that item_id or by entity_type + entity_id (owner or admin). Whether something can be undone is in each operation's description.
• Every result carries structuredContent (JSON in snake_case) and, as text, the same JSON (or a summary, when it is too large). An error comes with isError, the same body as the API and a text that says the code, the field (Field: …), the first problems (Problems: …), how long to wait when it applies and the request_id.
• A response too large for one message comes shortened, with mcp_notice: a page of a list comes back with a smaller limit and its next_cursor continues right after what came; otherwise the notice says what was left out and how to ask for the rest.

What the MCP does not do

• It does not create, edit, test or delete webhooks, rotate their secret or resend deliveries: that belongs to the screen. Through the MCP you read subscriptions, events and deliveries.
• It does not create or rotate API keys (neither does the API).
• Connected mailboxes and calendars, only with the three locks (see Permissions).

Disconnect

Each person sees and disconnects their apps in Settings → API & MCP → MCP; owners and admins see the whole organization's. Disconnecting cuts access instantly.