MCP server: Claude, ChatGPT and other assistants

The desk is an MCP server at https://<your desk>/mcp (Streamable HTTP). An assistant connected to it can search and read cases, log new ones, add notes, update them and draft or send replies, as the person who connected it and with only the permissions they chose.

In the desk, Settings → AI assistants (under Your account) shows:

• the server address, with a copy button;
• the steps for each assistant, with ready-to-copy commands;
• an example chat: a morning's triage that links cases to an incident and drafts the update for the requesters;
• the tools and the permission each needs, read from the server itself, in tabs: Core for the desk's own, then one per plugin that is on;
• the assistants you have connected, under Your connections, with Disconnect.

What it can do

Tool	Permission	What
search_cases	cases:read	Cases with the inbox filters: words, status, priority, unit, assignee ("me", "unassigned"), label, account, contact, due soon.
get_case	cases:read	A case with its details, the request and the latest 100 messages and events of the conversation, internal notes included. earlierMessages says how many come before; before (an entry's id) returns the 100 before it.
list_views	cases:read	Open-case counts and the saved views with their counts.
list_units	cases:read	The units you can see, with their ids.
create_case	cases:write	Log a case for a requester (a contact or a new address), as you.
add_note	cases:write	An internal note.
update_case	cases:write	Status, priority, labels, assignee or unit.
draft_reply	cases:write	A reply saved as a draft for a person to check and send.
send_reply	cases:reply	A reply emailed to the requester now.
find_contacts, find_accounts	contacts:read	Requesters and companies.
report_summary	reports:read	The report numbers for 7, 30 or 90 days.

With the Software Development plugin on, there are also tools for its projects, access, tasks and sprints, by dev:read, dev:write and dev:admin (the list, Software Development).

An assistant only sees the tools its permissions allow, and never more than you can see in the desk (your units, and cases restricted to staff in other countries stay hidden).

[!TIP] Drafts first. draft_reply saves the reply as an internal note marked Draft reply. On the case, Use this draft puts it in the reply box, where you check it and send it. Give an assistant cases:reply only if it should email requesters on its own.

Everything it changes shows via <its name> on the case's timeline, and each change is in the audit log.

Connecting

claude.ai, Claude Desktop and ChatGPT (OAuth)

Hosted assistants connect with OAuth, so nobody copies a token:

1. In the assistant, add a custom connector (in Claude: Settings → Connectors → Add custom connector; in ChatGPT: a custom connector in developer mode). The names of these menus change from time to time.
2. Enter the server address, https://<your desk>/mcp.
3. The assistant sends you to the desk. Sign in if asked, choose what it may do (and optionally limit it to one unit), and choose Allow.

The connection shows under Settings → API tokens as Connected app (MCP); Disconnect on Settings → AI assistants ends it. Its access lasts an hour at a time and renews by itself; after 30 days without use it has to be connected again.

[!NOTE] The desk must be reachable from the internet for this (a local development desk isn't).

Claude Code

With OAuth (Claude Code opens the browser for the approval):

claude mcp add --transport http desk https://<your desk>/mcp

Or with an API token from Settings → API tokens:

claude mcp add --transport http desk https://<your desk>/mcp --header "Authorization: Bearer sdt_…"

Other clients

Any MCP client that speaks Streamable HTTP works:

• with an Authorization: Bearer sdt_… header (an API token), or
• with OAuth 2.1, as below.

With OAuth 2.1:

What	How
Discovery	The server answers 401 with a WWW-Authenticate header pointing to /.well-known/oauth-protected-resource.
Authorization server metadata	At /.well-known/oauth-authorization-server.
Registration	Clients register themselves (dynamic client registration).
PKCE	Required, S256.
Redirects	Must be https, a local address or the app's own scheme.

The server is stateless: no sessions, and GET /mcp (a server-to-client stream) answers 405.

Limits

Limit	Value
Requests	300 a minute per token or connection.
Where OAuth access tokens work	Only at /mcp; for the REST API, use an API token.
Long messages in get_case	Cut at 4,000 characters, with a note of how much was left out.