Connecting AI Assistants

Why It Matters

Connect your usual AI chat to Kit to list open jobs, check pending reviews, or prepare a security queue briefing from current records. MCP (Model Context Protocol) gives the assistant tools for your account; you choose which modules it can read or change.

What You Need

• A Kit account with a verified email address. Any member can connect; account admin access is not required.
• A chat app with remote MCP and browser OAuth support, and permission to add a custom connection in that app.

The connection belongs to you. Your consent, the account’s active products, and your current role determine access. Kit checks record permissions on every call. Most write tools also require an active Kit subscription.

Use these URLs for different purposes:

Purpose	Server URL	Sign-in
Your Kit account and its tools	https://startupkit.app/api/v1/mcp	Browser OAuth: choose your account and module access
Public docs, pricing and hiring templates	https://startupkit.app/mcp	None; cannot read account records

For account access, select Streamable HTTP and OAuth wherever the client asks. Kit supports automatic OAuth client registration; leave client ID and secret blank when using that option. A Kit REST API key cannot replace this sign-in.

If account MCP calls return 403 with api_ip_restricted, ask a security manager to check the account’s IP restrictions. Hosted clients send calls from their provider’s infrastructure; allowing your laptop’s IP alone may block them.

Setup

Start with your chat app below. Menu labels follow the English interface. These instructions were checked against provider documentation on October 15, 2026; they describe documented connection paths, not completed Kit sign-in tests in every client. Availability can depend on your plan, region, workspace policy and app version.

ChatGPT (desktop, web and mobile)

Create the connection on the web, then use the installed plugin from a supported ChatGPT desktop, web or mobile chat.

1. Open ChatGPT on the web and choose Plugins > + > Add custom MCP server.
2. Name it Kit. Under Connection, enter https://startupkit.app/api/v1/mcp and select OAuth. Use dynamic client registration if offered.
3. Review the connection warning and select Create as a plugin.
4. Install the resulting plugin from your personal plugins or the workspace where you created it. Complete Kit’s browser consent when prompted: choose the account and start with the module’s Read access.
5. Start a new chat, type @, and select Kit before your request.

If the add-server option is missing, check account availability and ask your workspace admin about custom MCP permissions. Workspace security restrictions, including Lockdown, can prevent access. Adding Kit to a local Codex configuration does not add it to hosted ChatGPT.

Sources: OpenAI’s custom MCP setup, supported plugin surfaces, and workspace plugin controls.

Claude (web, desktop and mobile)

Use Claude’s custom connector in Claude Desktop or on claude.ai. It is tied to your Claude account and also works across supported Claude mobile apps; a local proxy is unnecessary.

1. Open Customize > Connectors > + Add > Add custom connector.
2. Enter Kit and https://startupkit.app/api/v1/mcp, then Continue.
3. Review the detected OAuth settings and continue. Under Authentication, choose Sign in now; under OAuth client, choose Register automatically. Leave fixed request headers empty.
4. Select Add and complete Kit’s browser consent. If the connector still shows Connect, select it to sign in.
5. In a chat, open + > Connectors and enable Kit for that conversation.

Custom connectors are available on Free, Pro, Max, Team and Enterprise; Free allows one. On Team, an Owner or Primary Owner adds Kit under Organization settings > Connectors > Add > Custom > Web. Enterprise also permits a custom role with Manage access to Libraries. Each member then uses Customize > Connectors > Connect to authorize their own Kit identity.

Source: Claude’s remote connector guide.

Perplexity

Perplexity documents remote custom connectors for Pro, Max and Enterprise. Start in the web interface; do not assume every desktop surface exposes connector creation.

1. Open Plugins in the sidebar, or Customize > Connectors if Plugins is absent.
2. Choose Add custom > Connector > Add MCP connector > Remote.
3. Enter Kit and https://startupkit.app/api/v1/mcp. Select OAuth and Streamable HTTP.
4. Review the warning, select Add, then open the connector card to authenticate and enable it. Complete Kit’s consent with your own identity.

In Enterprise, an admin must permit custom connectors. Use individual authentication for Kit; each teammate should connect their own account.

Sources: Perplexity’s setup guide and plan availability.

Gemini Apps

Google’s custom-app route currently requires a personal Google account, age 18+, location in the US, English, and Keep Activity enabled. Work and school accounts are excluded. Set up on the web; Google documents use afterward on web and mobile.

1. Open Gemini on the web, then Settings > Connected Apps. Some accounts show Personal Intelligence first.
2. Under Custom apps, add https://startupkit.app/api/v1/mcp, select Next, and complete browser authorization. Kit supports dynamic registration, so extra client credentials are unnecessary.
3. In a chat, type @ and select the custom app to use its tools.

If these eligibility conditions do not match your account, use another supported client. Gemini CLI has its own setup; its MCP support does not establish availability in Gemini Apps.

Source: Google’s custom-app requirements and setup.

Mistral Vibe Work (formerly Le Chat)

An administrator adds the connector. On Free, Pro and Student accounts, the account owner is the administrator by default.

1. Open Connectors > + Add Connector > Custom MCP Connector.
2. Use the unique name kit and server URL https://startupkit.app/api/v1/mcp.
3. Select Connect and complete the detected OAuth sign-in and Kit consent.

Mistral documents OAuth with dynamic client registration. Under My Connectors > Functions, keep write functions on manual approval. Dynamic tool discovery, resources and automatic prompt templates are not yet supported.

Sources: Mistral’s MCP connector guide and the Le Chat rename.

Microsoft Copilot

Microsoft’s consumer Copilot connections guide does not document adding an arbitrary Kit MCP URL. Use a client above for a direct chat connection. Copilot Studio supports adding an MCP server to an agent, but that is a separate organization-managed agent setup, subject to its own permissions and policies.

Verify the Connection

In a private chat with Kit enabled, ask:

Use Kit's whoami tool. Show my account_name, account_id and user_id.
Do not change anything.

Check the account before continuing. whoami verifies identity, not granted scopes; review those under Connected clients. Then try one read request for a module you granted:

• “Which job postings are open, and how many applications does each have?” (hiring_list_job_postings)
• “Which hiring reviews are waiting for my decision?” (hiring_list_pending_decisions)
• “What’s in my CSiRT queue right now, critical first?” (csirt_list_my_queue)

Start with Read access. A Read & write grant authorizes actions; it does not promise a human confirmation before every call. Review the client’s tool controls before enabling writes. Tool results enter that provider’s context and may remain in its transcripts or memory; use your organization’s approved account and avoid shared chats for candidate or vulnerability details.

Coding Agents and Local Clients

For more coding agents, editor assistants and personal agents, see Connect AI Agent Harnesses to Kit.

Let your agent set itself up

Paste this line into Claude Code, Codex CLI, Cursor, or another agent that can configure its MCP connections:

Fetch and execute the appropriate instructions to set me up for Kit from https://startupkit.app/agent-setup/prompt.md

The agent fetches Kit’s setup document, registers kit for your account and public kit-docs, and tells you when to approve browser consent. The Onboard your agent button in the docs header copies the same line. Chat apps without configuration tools still need the manual setup above.

Codex desktop

In Codex desktop settings, open MCP servers > Add server, choose Streamable HTTP, and enter https://startupkit.app/api/v1/mcp. Save, select Restart, and use Authenticate when prompted. Check /mcp for connection status.

The local Codex desktop, CLI and IDE clients share config.toml. ChatGPT’s hosted chat connection uses the separate plugin setup above. Source: OpenAI’s MCP guide.

Claude Code (CLI)

Run this in your terminal:

claude mcp add --scope user --transport http kit https://startupkit.app/api/v1/mcp

Or add to your .mcp.json config file:

{
  "mcpServers": {
    "kit": {
      "type": "http",
      "url": "https://startupkit.app/api/v1/mcp"
    }
  }
}

Codex CLI

Run this in your terminal:

codex mcp add kit --url https://startupkit.app/api/v1/mcp

Complete browser consent if prompted during registration; otherwise run codex mcp login kit. Use codex mcp list to inspect the server and its authentication status. Codex speaks Streamable HTTP directly, so no mcp-remote proxy is involved. Restart any open Codex session to load the new server.

Equivalent entry in ~/.codex/config.toml:

[mcp_servers.kit]
url = "https://startupkit.app/api/v1/mcp"

After editing the file by hand, still run codex mcp login kit once to obtain a token. Check the connection with codex mcp list; drop the credential with codex mcp logout kit.

OpenCode

Add the server to opencode.json, either the global one at ~/.config/opencode/opencode.json or a per-project file in your repo root:

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "kit": {
      "type": "remote",
      "url": "https://startupkit.app/api/v1/mcp",
      "enabled": true,
      "oauth": {}
    }
  }
}

Then authorize:

opencode mcp auth kit

opencode mcp list shows each server’s authentication status, and opencode mcp logout kit removes the stored token. "oauth": {} states that this server authenticates through OAuth; "oauth": false is the opt-out used for servers that take a static API key in headers instead. Kit does not.

Clients that only run local servers

Claude Desktop no longer needs this: use the custom connector above. An MCP client that can only launch local servers can still reach Kit through the mcp-remote proxy, which runs the OAuth flow on your machine:

{
  "mcpServers": {
    "kit": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://startupkit.app/api/v1/mcp"]
    }
  }
}

Authorization Flow

When your MCP client connects for the first time:

1. Your browser opens an authorization page on Kit
2. If you belong to multiple accounts, you select which one to connect
3. You choose which modules the assistant can access, and whether each is read-only or read & write
4. Kit issues a token scoped to that account and those modules
5. The client stores the token and refreshes it automatically

Tokens expire after 2 hours and are auto-refreshed. Reconnect if you revoke access, the connection goes 90 days without being used, or you need to delegate additional module scopes. An admin approving more Kit access does not expand an existing OAuth grant. See Automatic Disconnection below.

Scopes

MCP access is granted per module. Each module has a read scope and a write scope:

Module	Read Scope	Write Scope	What It Covers
Hiring	hiring_read	hiring_write	Job postings, applications, reviews, talent pool, templates, and Career Portal tools
CSiRT	csirt_read	csirt_write	Vulnerability reports, triage, researcher messages, bounties, program setup
Outreach	outreach_read	outreach_write	Campaigns, prospects, email drafts, metrics
Compensation Research	compensation_read	compensation_write	Salary benchmarks, market trends, role and location comparisons, and your tracked roles and regions (tracking also needs Hiring)
Training	training_read	training_write	Training programs, slides, quizzes, attestations, completion status, and participant invitations
Performance	performance_read	performance_write	Review cycles, participants, your own reviews, and the SOC 2 evaluation register
Scheduling	scheduling_read	scheduling_write	Your own booking links and the helpful links shown on their booking pages
Team	team_read	team_write	Members and invitations

Every connection includes the base mcp scope. Global tools such as whoami, docs search, pricing plans, PDF sanitization, IP investigation and email checks remain available without a module grant. The access_request and access_list_requests tools also use this base scope and need no subscription: your agent can submit your explained module-access request and check its outcome. Choosing global tools only grants no module access.

Kit’s built-in assistant links to the access-request form, where you must be signed in. Enter, review, and submit your explanation there. Native chat does not submit access requests or notify admins. An external MCP client with your delegated OAuth access can submit a request and notify admins when you ask it to.

The Consent Screen

When you authorize a connection, the consent screen walks you through:

1. Pick the account: if you belong to multiple accounts, choose which one to connect
2. Choose module access: each module appears as a row with a Read | Read & write segment. Writes are off by default; switch a module to Read & write only if the assistant should take actions rather than only look. Modules with risky write tools show a warning line explaining what you’re enabling.

Modules your account doesn’t have are hidden from the consent screen. Modules the account has but you don’t are shown dimmed and marked not part of your role: you can see they exist, but you can’t grant them. Kit drops them server-side even if they’re submitted anyway, so a connection can never hold a scope its owner has no access to. For Hiring, Security, Outreach, Training, or Performance, submit an explained request through Access requests, MCP Setup, or your agent. An account admin decides in Kit; after approval, reconnect to grant any missing module scopes. See Requesting and Reviewing Access. Read & write for Team and Compensation Research can only be granted by account admins.

Tools from modules you didn’t grant never appear in the assistant’s tool list.

Connections authorized before module scopes existed have been disconnected. Reconnect through the consent screen and pick the modules you want to grant.

To change what a connection can do, revoke it on the MCP Setup page and connect again. The new consent replaces the previous grant.

Managing Connected Clients

The MCP Setup page shows your connected clients for the current account with:

• App name: The MCP client that connected
• Scopes: Per-module access granted, shown as chips (R for read, RW for read & write)
• Authorized at: When the connection was made
• Last used: When the client last called a tool

Click Revoke to disconnect a client. The client will need to re-authorize to connect again.

Every user can also review their own connections, across all accounts they belong to, at Account Settings → Connected clients. Admin access isn’t required; you always control the clients you personally authorized.

Automatic Disconnection

A connection that goes 90 days without being used is disconnected automatically by a nightly sweep. This is a hygiene measure for forgotten credentials: a token left on a laptop you stopped using shouldn’t stay valid forever.

What counts as use:

• Any API call from the client resets the clock.
• A token refresh counts too. A client that stays connected refreshes roughly every two hours, so it never goes dormant, no matter how long it sits idle between actual requests.
• Activity is measured across the whole connection, not per token, so refreshes and calls both keep it alive.

What you’ll see:

• Once a connection is within 30 days of lapsing, both settings pages show a warning next to it: “Disconnects on October 12, 2026 unless used”.
• When it’s disconnected, Kit emails you (“Claude Code was disconnected from Kit”), naming the client, the account, and when it was last used. This email is always sent; it’s the only signal a credential stopped working.

To reconnect, run the authorization flow again from your MCP client and approve access. The disconnection removes a credential, never data.

Refused Is Not Disconnected

If your account requires passkeys and you hold none, your connection isn’t disconnected; it’s refused. Kit turns each call away while the answer stays no, because a token cannot present a passkey; the grant itself is untouched.

	Refused (no passkey)	Disconnected (90 days idle, or revoked)
The grant	Survives, still listed on your MCP Setup page	Removed
To fix it	Add a passkey at Account Settings → Passkeys	Run the authorization flow again
Re-authorization	Not needed; calls resume on the next request	Required

Nothing is revoked and nothing is lost either way. See Passkeys for what to enroll.

Troubleshooting

Problem	What to check
No option to add Kit	Check the provider’s account, region and workspace requirements above. Try its web setup first.
Only public docs appear	Use https://startupkit.app/api/v1/mcp and complete OAuth; /mcp is public.
Wrong Kit account	Revoke the connection, reconnect and choose the intended account on Kit’s consent screen.
Missing module tools	Check your module consent, current Kit role, active products and the client’s enabled-tool filters.
Your Kit role blocks a module	Request the access your task needs, with an explanation for your account admins. The agent can submit it; only an account admin can decide in Kit.
Access approved but the client is still blocked	Approval leaves existing OAuth scopes unchanged. If the required module scope is missing, reconnect with that consent. Also check record permissions, product availability, and any subscription requirement.
A write is refused	Check Read & write consent, record permissions, any required admin role and subscription.

Quick Checklist

• Choose your chat app and check its custom-connector requirements
• Add Kit using your chat app’s connector or plugin settings, or your coding client’s configuration
• Authorize the connection when your browser opens: pick the account and choose module access (Read or Read & write) on the consent screen
• Verify whoami returns the intended account, then try one read-only request
• Verify the connection appears in Connected Clients

For the separate account-level controls behind Kit’s built-in AI (provider keys, preferred provider, spend caps, and usage), see AI Providers & Spend Controls.