Connect an AI client

Scytale runs a hosted MCP server that gives AI agents read-only access to your compliance data — the same controls, audits, policies, monitors, vendors, people and risks you see in the app. Point Claude, Claude Code, ChatGPT or Codex at the URL below, sign in as a Scytale admin, and the agent can answer questions from your live data.

The server cannot change anything in Scytale. Every tool it exposes reads; none writes.

Use the host your Scytale data lives in. Note that the US host carries no region segment. Examples on this page use the US URL — substitute your own.

The server speaks MCP over Streamable HTTP. It is hosted by Scytale in each region; there is no self-hosted or local version.

• A Scytale account with the admin role in the company you want to connect. Other roles cannot authorize a client, and neither can Scytale support acting on your behalf.
• One of the supported clients: Claude (web and desktop), Claude Code, ChatGPT (web) or Codex (CLI, IDE extension, or Codex inside the ChatGPT desktop app). These are the only clients Scytale's authorization server accepts today; any other MCP client is refused with invalid_client before sign-in starts.
• ChatGPT and Codex are two different connection paths, even though both come from OpenAI. ChatGPT connects through its Apps settings; Codex connects through its own MCP configuration and CLI. Setting up one does not set up the other.
• The URL is all you need. There is no API key, client ID or secret to create or paste — the client discovers Scytale's authorization server from the URL and completes sign-in in your browser.

Custom connectors are available on every Claude plan. The desktop app and claude.ai share the same connector list, so you add it once.

On a Free, Pro or Max plan

Free accounts can add one custom connector.

1. Open Customize → Connectors.
2. Click + and choose Add custom connector.
3. Paste your MCP URL, for example https://api.scytale.ai/mcp/v1. Leave Advanced settings empty — Scytale does not use a client ID or secret.
4. Click Add, then Connect and follow the authorization steps.
5. In a conversation, open the + menu → Connectors and switch Scytale on.

On a Team or Enterprise plan

An organization Owner adds the connector once; everyone else connects to it individually.

Owner:

1. Open Organization settings → Connectors.
2. Click Add, hover over Custom and choose Web.
3. Paste the MCP URL. Leave Advanced settings empty.
4. Click Add.

Each member:

1. Open Customize → Connectors and find the Scytale connector.
2. Click Connect and follow the authorization steps. Each person signs in with their own Scytale admin account and picks their own company.

Add the server, then authorize it:

claude mcp add --transport http scytale https://api.scytale.ai/mcp/v1
claude mcp login scytale

claude mcp login opens your browser for the authorization steps. You can also run /mcp inside a Claude Code session, pick scytale and choose Authenticate.

By default the server is registered for the current project only. To make it available in every project, add --scope user:

claude mcp add --transport http --scope user scytale https://api.scytale.ai/mcp/v1

To check the connection, run claude mcp list — Scytale should show as Connected. To switch company or sign in again, run claude mcp logout scytale (or choose Clear authentication in /mcp) and then claude mcp login scytale.

ChatGPT connects to Scytale as a custom MCP app. Before you start:

• You need a Plus, Pro, Business, Enterprise or Edu plan. Free accounts cannot add custom apps.
• Developer mode must be on: open Settings → Apps (shown as Apps & Connectors in some accounts), scroll to Advanced settings and switch Developer mode on.
• On a Business, Enterprise or Edu workspace, a workspace owner or admin must allow custom apps before the option appears for members.

Then create the app:

1. Open Settings → Apps and click Create.
2. Enter a name, for example Scytale, and a short description.
3. Paste your MCP URL, for example https://api.scytale.ai/mcp/v1.
4. Under Authentication, choose OAuth. Leave any client ID or client secret field empty - Scytale does not use them.
5. Click Create. ChatGPT opens a window for the authorization steps: sign in to Scytale, choose a company, approve the read access. When the window closes, ChatGPT scans the server for its tools.
6. In a conversation, open the + menu, choose the Scytale app, and ask your question. Apps added in Developer mode are enabled per conversation, so pick it again in a new chat or name it in your prompt.

This is the path for regular ChatGPT conversations in the browser. It does not configure Codex; for the Codex CLI, IDE extension or Codex inside the ChatGPT desktop app, follow the Codex section below.

This section applies to the Codex CLI, the Codex IDE extension and Codex inside the ChatGPT desktop app. All three read the same configuration, so you set the server up once and it is available in all three. It does not connect Scytale to regular ChatGPT conversations - for those, use ChatGPT (web) above. Add the server, then sign in:

codex mcp add scytale --url https://api.scytale.ai/mcp/v1
codex mcp login scytale --scopes read:controls,read:audits,read:policies,read:monitors,read:vendors,read:people,read:risks

Pass the permissions explicitly, as above. Codex takes its default permissions from the authorization server's metadata rather than from the MCP server's, and a plain codex mcp login scytale can end in a connection that looks signed in but holds no Scytale permission: the consent screen lists nothing, Codex reports success, and every tool call then fails with Auth required. The explicit list is always safe and matches what the consent screen shows.

codex mcp login opens your browser for the authorization steps. The server is saved to ~/.codex/config.toml:

[mcp_servers.scytale]
url = "https://api.scytale.ai/mcp/v1"

No bearer_token_env_var or http_headers entry is needed; OAuth is Codex's default for HTTP servers. codex mcp login keeps the credential it obtains outside this file, so the entry stays as shown. To check the connection, run codex mcp list. To switch company or sign in again, run codex mcp remove scytale, then add the server and log in again.

The first time a client calls the server it is answered with 401 and sent to Scytale to sign you in. What you see in the browser:

1. Sign in to Scytale with your usual account, if you are not already signed in.
2. Choose a company. Only companies where you are an admin are listed. If you belong to one company, it is the only option.
3. Approve the read permissions the client is asking for.

The browser returns you to the client and the connection completes.

The access the client receives is tied to the company you chose. It cannot see another company's data, even if you administer several. To work with a different company, disconnect or clear the client's authentication and connect again, choosing the other company.

Access is granted in short-lived tokens that the client renews in the background, so you do not sign in on every use. A connection lasts 40 days from the moment you authorized it; after that the next call fails with 401 and you go through the authorization steps again.

Check the connection in two steps, in this order, so a failure points at one cause:

1. Test the ping tool. Ask the agent something like "Use the Scytale ping tool with the message hello". A reply that echoes the message proves the client reaches the server and holds a valid session. From the command line, claude mcp list (Claude Code) or codex mcp list (Codex) shows the same thing: Scytale listed as connected.
2. Make a real read-only request. Ask for data you know exists, for example "List my audits" (the get_audits tool). A result from your own company proves the whole path: OAuth succeeded, the connection is bound to the right company, and the permissions you approved reach the data.

If step 1 works and step 2 fails, the connection is fine and the problem is permissions or company scope - see Troubleshooting. If step 1 fails, start from the URL and the authorization steps.

After connecting, the client lists the tools below. Every one of them reads data; there are no create, update or delete tools. The list shown by your client is authoritative — it grows as Scytale adds coverage.

Each get_* list tool returns pages of results; the agent pages through them for you. The single-item tools take an id from a list result. A list tool accepts the same filters as its endpoint in the API reference — employmentStatus and source on get_people, mitigationStatus, mitigationPlan and ownerId on get_risks, and so on — and the tool's own description, shown by your client, lists them too.

• Read-only. The server exposes no tool that can create, change or delete anything in Scytale, and no such tool can be enabled.
• Admin-only. Only company admins can authorize a client. The consent screen offers only the companies you administer; there is no way to grant access to any other.
• Company-scoped. Each connection is bound to the one company chosen at sign-in. Switching companies means authorizing again.
• Short-lived access. Access tokens expire after 30 minutes and are renewed by the client in the background; they are never shown to you.
• No shared secrets. There is no API key or client secret to leak, rotate or revoke. Disconnecting the client discards its copy of the credentials; there is not yet a way to revoke a connection from inside Scytale, and a connection that is not disconnected lapses 40 days after it was authorized. To cut off an existing connection, remove the user's admin role in that company or deactivate the user: the client's next token renewal, within 30 minutes, is refused.
• Standard OAuth 2.1 with PKCE over TLS. Scytale runs the authorization server; sign-in never happens inside the AI client.
• Your organization decides. In Claude Team and Enterprise plans only an Owner can add a custom connector, so Scytale is available to members only if an Owner chose to add it.