> ## Documentation Index > Fetch the complete documentation index at: https://docs.getwhys.io/llms.txt > Use this file to discover all available pages before exploring further. # MCP Setup > Shared GetWhys MCP prerequisites — endpoint, auth, tokens, and security — before you connect a specific client. This page covers the shared pieces every GetWhys MCP connection uses. When you're ready to connect a specific app, pick it from [MCP Overview](/integrations/mcp-overview#pick-your-client) or the sidebar. ## Before you start You'll need three things: * **An MCP-compatible app** — sometimes called an MCP client or host. This is whatever assistant or tool you want GetWhys to plug into. * **A GetWhys account** — you'll sign in during setup to authorize the connection. Your organization needs to be an existing GetWhys customer to use this. * **The GetWhys MCP endpoint** that matches your auth method (below). ## The GetWhys MCP endpoints GetWhys runs hosted (remote) MCP servers — nothing to install. Point your client at the URL that matches how you authenticate: | Endpoint | Use with | | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | | `https://api.getwhys.io/mcp` | **Individual OAuth** (you sign in with your GetWhys account) or an **Organization MCP API Token** (`gw_org_…`) | | `https://api.getwhys.io/mcp/org` | **OAuth MCP Connector** (OAuth client ID and secret from Integrations — org-wide access without each teammate signing in) | **Connection type:** remote URL over HTTPS. Individual users authorize through GetWhys OAuth; org setups use a bearer token or the OAuth MCP Connector credentials your admin generates in the product. ## Choose your auth method | Method | Endpoint | When to use | | ------------------------------ | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Organization MCP API Token** | `https://api.getwhys.io/mcp` | Recommended for most org-wide setups — one admin configures a token once; teammates don't authenticate individually. | | **OAuth MCP Connector** | `https://api.getwhys.io/mcp/org` | When your MCP platform expects OAuth client credentials (client ID + secret) instead of a static bearer token — shared org access without per-user GetWhys sign-in. | | **OAuth (individual)** | `https://api.getwhys.io/mcp` | Best for one person testing on their own account. Applies to your user only. | Where a client only supports end-user OAuth, use the individual path on `/mcp`. For org-wide OAuth connector flows, use `/mcp/org` and the credentials from the **OAuth MCP Connector** card. [Microsoft 365 Copilot](/integrations/mcp-microsoft-copilot) is OAuth-per-user by design. ### Authenticating with a token: header vs. query string There are two ways to pass an Organization MCP API Token, in order of preference: | Method | Format | Use when | | --------------------------- | ------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | | **HTTP header (preferred)** | `Authorization: Bearer ` | Your client supports setting a custom header — most config-file-based and CLI tools do. | | **Query string (fallback)** | `https://api.getwhys.io/mcp?access_token=` | Your client's connector UI doesn't expose a way to set a custom header (e.g. claude.ai's simple "add connector" flow). | Always try the header first. Only fall back to the query string if your client genuinely has no way to set one — a token in a URL is more exposed (browser history, logs, etc.) than a token in a header. ## Generate an Organization MCP API Token 1. Go to the GetWhys integration settings page: [app.getwhys.io/settings/integrations](https://app.getwhys.io/settings/integrations) 2. Scroll to the **MCP API Tokens** card. If you don't see this section, reach out via Teams, Slack, Google Chat, or email [support@getwhys.io](mailto:support@getwhys.io) — you may not have the required permissions. 3. Add a label and click **Generate**. MCP API Tokens card in GetWhys integration settings 4. Copy the token immediately — **it's only shown once.** If you lose it, revoke it and generate a new one. Use a distinct label per surface (e.g. `claude`, `writer`, `m365`) so you can tell tokens apart later. ## Set up an OAuth MCP Connector For platforms that connect via OAuth client credentials (not a static `gw_org_` token), use the **OAuth MCP Connector** card on the same Integrations page: 1. Go to [app.getwhys.io/settings/integrations](https://app.getwhys.io/settings/integrations). 2. Under **OAuth MCP Connector**, add a label and click **Generate**. 3. Copy the **Connector URL** (`https://api.getwhys.io/mcp/org`), **OAuth Client ID**, and **OAuth Client Secret** immediately — the secret is only shown once. 4. If your platform requires redirect URIs, click **Edit URIs** on the connector and add the callback URLs your MCP client provides. Paste the connector URL and OAuth credentials into your client's MCP / connector settings according to that product's OAuth MCP setup flow. ## Org-wide setup is per surface An Organization MCP API Token is **shared org credentials**, but GetWhys still needs to be **configured separately on each surface** where you want it available. Setting it up in one place does not automatically enable it everywhere. | Surface | Where you configure it | Inherits from other surfaces? | | --------------------------------------------------------------- | ---------------------------------------------------------- | ----------------------------------------------------------------------------------------- | | [Claude.ai / Claude Desktop](/integrations/mcp-claude) | Org admin at claude.ai → custom connectors | **Partially** — Desktop users signed into the same Claude org typically see the connector | | [Claude Tag (`@Claude` in Slack)](/integrations/mcp-claude-tag) | Claude org admin → Claude Tag → Access bundles | **No** — does not inherit from Claude.ai | | [ChatGPT](/integrations/mcp-chatgpt) | ChatGPT → Settings → Plugins / Connectors (Developer Mode) | **No** | | [Gemini Enterprise](/integrations/mcp-gemini) | Gemini Enterprise → Custom MCP Server data store | **No** | | [Microsoft 365 Copilot](/integrations/mcp-microsoft-copilot) | Microsoft 365 admin center → Copilot connectors | **No** — users connect their own GetWhys accounts | | [Writer](/integrations/mcp-writer) | Writer AI Studio → Connectors & Tools | **No** | | [Typeface](/integrations/mcp-typeface) | Typeface MCP connection flow | **No** | | [Cursor / custom agents](/integrations/mcp-generic) | Each app's MCP / connector settings | **No** | **Claude.ai does not set up Claude Tag.** Even if GetWhys is already connected as an org-wide connector in Claude.ai, you still need to complete [Claude Tag](/integrations/mcp-claude-tag) separately — Access bundles, credentials, and plugins for Slack are provisioned on their own. Claude Tag is also **not** the [GetWhys Slack bot](/integrations/slack). The Slack bot is a separate GetWhys integration; Claude Tag brings GetWhys into Anthropic's `@Claude` in Slack. ## Next: pick your client Custom connector, Claude Code CLI, and the GetWhys skill. Access bundles and plugins for `@Claude` in Slack. Developer Mode connectors in OpenAI Chat. Custom MCP Server data store in Google Cloud. Federated connector for Microsoft 365 Copilot Chat. WRITER Agent via Writer's MCP gateway. Typeface MCP via OAuth. Cursor, custom agents, or any other MCP-compatible app. ## Verify the connection Once connected, confirm it's working by asking your assistant: > "Who am I in GetWhys?" — or — "Check my GetWhys connection." This runs the `whoami` tool and returns your organization (and your user, if you connected with individual OAuth). If you see those, you're connected. ## Authentication & permissions GetWhys connects via OAuth — users sign in with their existing GetWhys credentials, and the connection grants access scoped to their organization's workspace, including personas, messaging frameworks, brand voice, and the research corpus. GetWhys can also connect via an MCP token generated within the authenticated GetWhys context. This is the better option for whole-organization access, and grants the same access as OAuth authentication. ## Security, data access, & privacy All data transmitted through the GetWhys MCP is encrypted in transit and at rest. Access tokens are handled server-side and never exposed to the client. Tokens are scoped to your user and organization — treat them like passwords: * Don't commit them to source control. * Don't share them across teammates — generate one per person or per agent. * Rotate them periodically and after any device change. If you suspect a token has leaked, revoke it immediately and generate a new one. Data shared via MCP is governed by your organization's existing data protection agreement with GetWhys. ### Revoking tokens Return to the **Integrations** page, find the token in the MCP API Tokens list, and click **Revoke**. The token stops working immediately. Other tokens are unaffected. ## Pricing & support GetWhys charges a flat rate for unlimited MCP access. If GetWhys MCP isn't yet enabled for your organization, contact your workspace owner or your GetWhys contact. For support: reach out via Teams, Slack, Google Chat, or email [team@getwhys.io](mailto:team@getwhys.io).