Other clients

Any MCP client can connect to Typestream if it supports remote servers over streamable HTTP with OAuth, as most now do. For one that only runs local (stdio) servers, a small bridge does the rest.

Clients with remote servers and OAuth

Add a remote (HTTP) MCP server with the server URL, https://api.dev.typestream.nz/mcp, and no other settings. When it connects, it's sent to Typestream to sign in; pick the organisation and choose Allow.

That works because the server describes itself, as the MCP specification asks:

• A request without a token is answered 401 with a WWW-Authenticate header whose resource_metadata points at the server's protected-resource metadata (RFC 9728), at /.well-known/oauth-protected-resource/mcp on the same host.
• That names the authorization server, whose metadata (RFC 8414) is at /.well-known/oauth-authorization-server: the authorization, token and registration endpoints.
• Clients register themselves (RFC 7591 dynamic client registration), sign the person in with the authorization code flow and PKCE (S256), and ask for a token for the server's URL as the resource (RFC 8707).

Access tokens last an hour; ask for offline_access to get a refresh token, which lasts 30 days. Send the access token as Authorization: Bearer … on every request.

Clients that only run local servers

Run mcp-remote as the local server; it handles the sign-in and forwards everything to Typestream. It needs Node.js.

npx -y mcp-remote https://api.dev.typestream.nz/mcp

In a client configured with JSON, that's:

{
  "mcpServers": {
    "typestream": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://api.dev.typestream.nz/mcp"
      ]
    }
  }
}

What to expect

• tools/list returns every tool Typestream's assistant uses, except the two that only work in its chat. See Connected agents.
• Tool results are JSON, as structuredContent and as text.
• A call that needs the person's go-ahead returns "status": "needs_confirmation" with the price and a confirm_token. Call the same tool again, with exactly the same arguments plus confirm_token, only after they agree. Tokens last 15 minutes and work once.
• A 403 means connected agents are off for the organisation; a 401 with error="invalid_token" means the access was revoked or expired, so sign in again.