> ## Documentation Index
> Fetch the complete documentation index at: https://docs.topicflow.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP Server

> Connect Topicflow to Claude, Cursor, ChatGPT, and other AI assistants via the Model Context Protocol

Topicflow runs a hosted [Model Context Protocol](https://modelcontextprotocol.io) server that lets AI assistants like Claude, Cursor, ChatGPT, and any other MCP-compatible client read your Topicflow workspace and draft updates on your behalf — with explicit confirmation before anything is written.

## Server URL

```
https://app.topicflow.com/mcp
```

The endpoint speaks streamable HTTP MCP and is protected by OAuth 2.1 with PKCE. The first time your client connects you will be redirected to Topicflow to sign in and approve access. No API keys or static tokens to manage.

## Connecting a client

Most MCP clients accept a JSON config block. Paste this into your client's MCP server settings:

```json theme={null}
{
  "mcpServers": {
    "topicflow": {
      "type": "http",
      "url": "https://app.topicflow.com/mcp"
    }
  }
}
```

### Claude Desktop and Claude Code

Add the server in **Settings → Connectors → Add custom connector** (Claude Desktop) or run `claude mcp add --transport http topicflow https://app.topicflow.com/mcp` (Claude Code). Claude will open a browser window for the Topicflow sign-in.

### Cursor

**Settings → MCP → Add new MCP server**, then paste the JSON config above. Cursor handles the OAuth flow automatically.

### ChatGPT

In a ChatGPT workspace that supports custom connectors, add a new connector with the URL above and choose **OAuth** as the auth method. ChatGPT will discover the Topicflow authorization server and prompt you to sign in.

### Other clients

Any client that supports MCP over streamable HTTP with OAuth 2.1 dynamic client registration will work. Point it at the URL above — discovery and registration happen automatically.

## OAuth scopes

When you approve a connection, the client requests one or more of these scopes:

* **`mcp`** — call MCP tools against your Topicflow workspace
* **`profile:read`** — read your name, email, and team membership
* **`external-events:read`** — read connected work activity (commits, PRs, tickets, deals) surfaced through `query_external_events`

Access is bound to **you and your organization**. The MCP server only ever returns data you can already see in Topicflow — visibility rules for private feedback, other people's one-on-ones, and team-scoped goals are enforced exactly as they are in the app.

## Available tools

### Read tools

| Tool                    | What it returns                                                                                                  |
| ----------------------- | ---------------------------------------------------------------------------------------------------------------- |
| `get_user_infos`        | Look up people by name, team, or email — including manager, team, and career track                               |
| `list_meetings`         | Recent meetings filtered by participants, title, one-on-one vs. team, and date range                             |
| `list_goals`            | Goals you own, manage, or can see, with state and progress                                                       |
| `list_feedback`         | Feedback you've given or received                                                                                |
| `list_assessments`      | Review assessments visible to you                                                                                |
| `list_review_programs`  | Active and recent review programs                                                                                |
| `list_my_review_tasks`  | Reviews and self-reviews currently assigned to you                                                               |
| `query_external_events` | Work activity for a visible user from connected tools (GitHub, Jira, Linear, Salesforce, etc.) over a date range |

### Write tools

Write tools never commit on the first call. They follow a **preview → confirm** pattern so the assistant can show you exactly what will be created before anything lands in Topicflow.

| Tool                  | What it does                                             |
| --------------------- | -------------------------------------------------------- |
| `create_feedback`     | Preview a piece of feedback for a teammate               |
| `create_goal`         | Preview a new goal with title and key results            |
| `create_goal_checkin` | Preview a progress update on an existing goal            |
| `create_recognition`  | Preview a recognition tied to a core value               |
| `confirm_creation`    | Commit a previously previewed creation by its pending ID |

A typical write flow:

1. Assistant gathers context with read tools (`list_meetings`, `query_external_events`, `list_assessments`).
2. Assistant calls a `create_*` tool and shows you the preview it returns.
3. You confirm.
4. Assistant calls `confirm_creation` with the pending ID, and the record is created in Topicflow.

If you don't confirm, nothing is written.

## Example prompts

Once connected, you can talk to your assistant the same way you would talk to Topicflow AI inside Topicflow:

* *"What did Riley ship this sprint? Draft recognition tied to our 'ship fast' core value."*
* *"Summarize my last three one-on-ones with Jordan and suggest topics for tomorrow."*
* *"Look at my open PRs and draft a goal check-in for my Q2 reliability goal."*
* *"What feedback have I given in the last month? Is anything missing for my upcoming review?"*

## Privacy and limits

* The MCP server respects every visibility rule in Topicflow. Private feedback stays private, and you cannot see other people's one-on-ones or scoped goals through MCP that you couldn't see in the app.
* Write tools always require explicit confirmation through `confirm_creation`. An assistant cannot create feedback, goals, check-ins, or recognition silently.
* You can revoke a connected client at any time from **Settings → Integrations → Connected apps**. Revoking immediately invalidates the OAuth tokens.
* Tokens are short-lived and refreshed automatically by the client. There are no long-lived API keys to rotate.

## What's next

<CardGroup cols={2}>
  <Card title="Topicflow AI" icon="sparkles" href="/ask-ai">
    Use Topicflow's built-in AI assistant
  </Card>

  <Card title="Integrations" icon="plug" href="/settings/integrations">
    Connect work tools that feed `query_external_events`
  </Card>

  <Card title="Roles and permissions" icon="shield" href="/settings/roles-and-permissions">
    Understand what each user can see
  </Card>

  <Card title="Visibility and privacy" icon="eye" href="/settings/visibility-and-privacy">
    See how visibility rules are enforced
  </Card>
</CardGroup>
