Model Context Protocol

Your agent, meet your command center

The MCP server is the bridge between your AI client — Claude Code, or anything else that speaks MCP — and the dashboard. Sign in once, approve the connection, and the agent works on the projects you can see, with the access you granted, and a receipt for every write.

No API key to paste, so there is also nothing for an agent to leak into your shell history.

Server endpoint

https://mcp.grafizum.com/mcp

Set it up

1

Add the server

In Claude Code, run the command below. Any MCP client: use the endpoint above as the server URL (Streamable HTTP, OAuth 2.1). If it speaks MCP, it finds its way here.

claude mcp add --transport http grafizum https://mcp.grafizum.com/mcp

https://mcp.grafizum.com/mcp

2

Approve the connection

Your client opens a one-card approval page on the dashboard. Sign in, choose the agent it acts as, and authorize. Projects and access default to the whole agent and stay editable afterwards.

3

Work

The agent can now read projects, tasks, calendar and memory — and write within its scopes. Every write lands in the activity log.

Switching sync mode

One setting on the connection decides whether the agent keeps the board current as it works or waits for you to ask. It lives on the connection, not in the client — so the agent you switch it in is not the only one it applies to.

Auto

Default

Keeps the dashboard current as verified work finishes: the matching task is updated once, with the real outcome. No duplicate tasks, no invented progress.

/gz-auto

Manual

On request

Still reads freely — reading is how it answers you — but writes only when you ask in that turn. Otherwise it says what it would sync and waits.

/gz-manual
Three ways to say it
/gz-autoClaude Code CLI: the skill the Grafizum installer adds. /gz-manual is the other direction.
/grafizum:autoAny client that lists the server's prompts. /grafizum:manual exists too.
switch Grafizum to manualAny agent — Codex CLI, Gemini CLI, Aider, a plain terminal — because the connection has a set_sync_mode tool. Say "back to auto" to return.

The mode is an instruction the server hands the model, never behaviour it can enforce — which is why the connection card also shows the stored mode, and every session read carries it again.

Add a custom MCP client

Claude Code is the shortest path. Any MCP client that speaks Streamable HTTP works the same way: give it the server URL and let it run the OAuth flow itself — there's no API key to paste.

Portable format — .mcp.json, Cursor, Copilot
{
  "mcpServers": {
    "grafizum": { "type": "http", "url": "https://mcp.grafizum.com/mcp" }
  }
}

VS Code keeps the same two fields under a top-level "servers" object in .vscode/mcp.json.

Discovery

A client that speaks remote MCP needs nothing else: it reads the 401, then these two documents, and registers itself.

OAuth server metadata

https://mcp.grafizum.com/.well-known/oauth-authorization-server

Protected resource metadata

https://mcp.grafizum.com/.well-known/oauth-protected-resource/mcp

What a connection can do

Read
  • Projects, status and progress
  • Tasks and to-do lists
  • Calendar and due dates
  • Project memory and the global handbook
  • Activity summaries (never raw secret payloads)
Write
  • Create and update tasks
  • Report project status
  • Record events and calendar entries
  • Write project knowledge (within its scopes)
Never
  • Vault secrets, GitHub tokens or SSH keys
  • Projects the connection wasn't granted
  • Your review decisions

The tools it exposes

The exact names your client lists, and what each one does. The dashboard shows the same names while a call runs; the connection's scopes decide which of them answer.

Session

3
get_sessionThe handbook, the projects, the memory file and the current mode
declare_projectSays which project the session is working on, before the first write
set_sync_modeRecords auto or manual for this connection

Read

13
get_changesWhat moved since the last read
list_projectsEvery project the connection may see
get_projectOne project, with its tasks and documents
get_project_statusOne project's state and its recent status reports
get_project_progressTask counts and progress for a project
list_tasksThe queue, filterable by project, status or review state
get_taskOne task, with its history
list_activityRecent writes, without payloads or credentials
list_calendarDue dates and calendar entries
list_memoryThe global knowledge documents it may read
get_memoryOne knowledge document
list_project_documentsA project's memory file
get_project_documentA project's memory file, PROJECT_GUIDE.md

Write

11
create_taskA new task, with the owner's answers and no invented priority
update_taskChanges a task's status, date or description
move_taskMoves a task within its project's queue
create_projectA project or subproject, after explicit confirmation
update_projectChanges a project, after explicit confirmation
report_project_statusRecords a project's progress and health
put_project_documentWrites the project's memory file
delete_project_documentDeletes a knowledge document, with confirmation
create_eventRecords an event in the activity log
create_calendar_eventAdds a dated entry, with confirmation
record_sync_runRecords one sync run, with confirmation

Manage connections

Every connection shows up under MCP in the dashboard, named after the agent it acts as. Rename it, narrow it to fewer projects, drop write access, or revoke it — changes apply to the next request, no reconnect needed. A connection lasts 30 days before it needs approving again; access tokens last 15 minutes and refresh on their own.

Open the MCP tab

How it's kept safe

  • OAuth 2.1 authorization code with PKCE. Tokens are stored hashed, access tokens last 15 minutes, and refresh tokens rotate — a reused one revokes the whole connection.
  • A connection is a ceiling, never a widening: it can never carry more scopes or projects than the acting agent already has, and vault, GitHub and delete scopes are never available.
  • Registration and authorization are rate-limited, and every write is checked against the connection's scopes and project list before it's accepted.
  • Approving shows the exact address the authorization code goes to, so a familiar-sounding client name can't hide where your access is heading.

Troubleshooting

The client says MCP login required (401)

The token expired or the connection was revoked. Re-run the client's authentication — approving it again takes one click.

The approval page says the request expired

A pending authorization is valid for 10 minutes and can be used once. Start authentication again from the client. Ten minutes is a window, not a personality test.

A tool call is refused

The connection may lack that scope or project. Check the MCP tab, then narrow or widen the connection there.

Open the MCP tabSecurity