Connecting AI Assistants

Why It Matters

MCP (Model Context Protocol) lets AI assistants like Claude interact directly with your Kit account — listing job postings, reviewing templates, inviting team members, and more. Instead of copy-pasting between your browser and an AI chat window, the assistant reads and acts on your real data.

What You Need

• A Kit account — any member can connect, admin access is not required
• An MCP client: Claude Desktop, Claude Code, Codex CLI, OpenCode, or any MCP-compatible app

Connecting is a personal act: the connection belongs to you, not to the account. What the assistant can reach follows your role — your per-module access levels, re-read on every call — so two people connecting the same client to the same account get different toolsets.

Setup

Navigate to Integrations > MCP Setup. You’ll see your MCP Server URL and ready-to-copy configuration for each client.

Claude Code (CLI)

Run this in your terminal:

claude mcp add --transport http kit https://startupkit.app/api/v1/mcp

Or add to your .mcp.json config file:

{
  "mcpServers": {
    "kit": {
      "type": "http",
      "url": "https://startupkit.app/api/v1/mcp"
    }
  }
}

Claude Desktop

Add this to your Claude Desktop configuration file:

{
  "mcpServers": {
    "kit": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://startupkit.app/api/v1/mcp"]
    }
  }
}

Claude Desktop uses mcp-remote to handle the OAuth flow via a local proxy.

Codex CLI

Register the server, then authorize it:

codex mcp add kit --url https://startupkit.app/api/v1/mcp
codex mcp login kit

codex mcp add only writes the config entry — codex mcp login is what opens your browser for the consent screen. Codex speaks Streamable HTTP directly, so no mcp-remote proxy is involved.

Equivalent entry in ~/.codex/config.toml:

[mcp_servers.kit]
url = "https://startupkit.app/api/v1/mcp"

After editing the file by hand, still run codex mcp login kit once to obtain a token. Check the connection with codex mcp list; drop the credential with codex mcp logout kit.

OpenCode

Add the server to opencode.json — either the global one at ~/.config/opencode/opencode.json or a per-project file in your repo root:

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "kit": {
      "type": "remote",
      "url": "https://startupkit.app/api/v1/mcp",
      "enabled": true,
      "oauth": {}
    }
  }
}

Then authorize:

opencode mcp auth kit

opencode mcp list shows each server’s authentication status, and opencode mcp logout kit removes the stored token. "oauth": {} states that this server authenticates through OAuth; "oauth": false is the opt-out used for servers that take a static API key in headers instead — Kit does not.

Authorization Flow

When your MCP client connects for the first time:

1. Your browser opens an authorization page on Kit
2. If you belong to multiple accounts, you select which one to connect
3. You choose which modules the assistant can access — and whether each is read-only or read & write
4. Kit issues a token scoped to that account and those modules
5. The client stores the token and refreshes it automatically

Tokens expire after 2 hours and are auto-refreshed. You don’t need to re-authorize unless you revoke access, or the connection goes 90 days without being used — see Automatic Disconnection below.

Scopes

MCP access is granted per module. Each module has a read scope and (except Compensation Research) a write scope:

Module	Read Scope	Write Scope	What It Covers
Hiring	hiring_read	hiring_write	Job postings, applications, reviews, talent pool, templates, and Career Portal tools
CSiRT	csirt_read	csirt_write	Vulnerability reports, triage, researcher messages, bounties, program setup
Outreach	outreach_read	outreach_write	Campaigns, prospects, email drafts, metrics
Compensation Research	compensation_read	—	Salary benchmarks, market trends, role comparisons (read-only)
Training	training_read	training_write	Training programs, slides, quizzes, attestations, completion status, and participant invitations
Performance	performance_read	performance_write	Review cycles, participants, your own reviews, and the SOC 2 evaluation register
Team	team_read	team_write	Members and invitations

The base mcp scope is always granted. It covers the global tools only: docs search, pricing plans, echo, the PDF sanitizer, IP investigation, and the email checker.

The Consent Screen

When you authorize a connection, the consent screen walks you through:

1. Pick the account — if you belong to multiple accounts, choose which one to connect
2. Choose module access — each module appears as a row with a Read | Read & write segment. Writes are off by default; switch a module to Read & write only if the assistant should take actions, not just look. Modules with risky write tools show a warning line explaining what you’re enabling.

Modules your account doesn’t have are hidden from the consent screen. Modules the account does have but you don’t are shown dimmed and marked not part of your role — you can see they exist, but you can’t grant them. Kit drops them server-side even if they’re submitted anyway, so a connection can never hold a scope its owner has no access to. To gain one, ask an admin for that module; the row links to the request.

Tools from modules you didn’t grant are invisible to the assistant — they never appear in its tool list.

Connections authorized before module scopes existed have been disconnected. Reconnect through the consent screen and pick the modules you want to grant.

To change what a connection can do, revoke it on the MCP Setup page and connect again — the new consent replaces the previous grant.

Managing Connected Clients

The MCP Setup page shows all connected clients with:

• App name — The MCP client that connected
• Scopes — Per-module access granted, shown as chips (R for read, RW for read & write)
• Authorized at — When the connection was made
• Last used — When the client last called a tool

Click Revoke to disconnect a client. The client will need to re-authorize to connect again.

Every user can also review their own connections — across all accounts they belong to — at Account Settings → Connected clients. Admin access isn’t required; you always control the clients you personally authorized.

Automatic Disconnection

A connection that goes 90 days without being used is disconnected automatically by a nightly sweep. This is a hygiene measure for forgotten credentials — a token left on a laptop you stopped using shouldn’t stay valid forever.

What counts as use:

• Any API call from the client resets the clock.
• A token refresh counts too. A client that stays connected refreshes roughly every two hours, so it never goes dormant, no matter how long it sits idle between actual requests.
• Activity is measured across the whole connection, not per token — so refreshes and calls both keep it alive.

What you’ll see:

• Once a connection is within 30 days of lapsing, both settings pages show a warning next to it — “Disconnects on October 12, 2026 unless used”.
• When it’s disconnected, Kit emails you — “Claude Code was disconnected from Kit” — naming the client, the account, and when it was last used. This email is always sent; it’s the only signal a credential stopped working.

Reconnecting is one click. Run the authorization flow again from your MCP client and approve access. Nothing is lost — the disconnection removes a credential, never data.

Quick Checklist

• Navigate to Integrations > MCP Setup
• Copy the config for your MCP client
• Run or paste it into your client’s configuration
• Authorize the connection when your browser opens — pick the account and choose module access (Read or Read & write) on the consent screen
• Test with “What job postings do I have?” in your AI assistant
• Verify the connection appears in Connected Clients