# Connect an MCP app

GitCafe runs an MCP server at `https://git.cafe/mcp`, so AI tools such as
Claude and ChatGPT can read repositories and, with your approval, work on
issues and pull requests. Each connection is limited to the repositories and
permissions you approve.

## Read public repositories without signing in

Add `https://git.cafe/mcp` to your MCP client as a remote server. Without
connecting an account, its read tools work on public repositories: code,
branches and tags, issues, pull requests, reviews and CI results.

A write tool, or `get_me`, asks the client to sign in, which starts the
connection steps below. Connect first if you want the tools to read private
repositories.

## Connect a client

You need a verified GitCafe account.

1. In your MCP client, add `https://git.cafe/mcp` as a remote MCP server.
2. Follow the sign-in link the client opens.
3. Check the app name, client ID and return address on the consent screen.
   GitCafe does not verify app names, so only continue if you started this.
4. Select the repositories the app may use. A connection covers at most 50
   repositories; repositories you create later are not included.
5. Review the permissions. Read access is included; write and admin access
   start turned off.
6. Choose **Approve connection** and confirm it's you if asked. You return to
   the client.

Choose **Deny access** to cancel. Never paste a token or password into a
connector's settings: the browser flow handles sign-in.

### Claude

Open **Customize → Connectors → Add → Add custom connector**. Enter a name and
`https://git.cafe/mcp`, keep the detected sign-in and automatic registration
options, then choose **Add → Connect** and approve the connection. Leave the
tools on **Needs approval** to review each call.

### ChatGPT

With developer mode enabled, open **Plugins → Create app → Create MCP App**.
Enter a name and `https://git.cafe/mcp`, keep **OAuth**, acknowledge the
custom-server warning and choose **Create**. Approve the connection, then open
the app and choose **Try in chat**.

Menus vary by client version and plan.

## What a connected app can do

With the permissions you approved, an app can:

- read your identity and its approved repositories (`get_me`);
- read code, branches, tags and search results;
- read and write issues, pull requests, comments and reviews;
- resolve review threads;
- merge pull requests, if you approved **pr:merge:write**;
- read CI runs, checks, jobs and shared logs (`ci_read`).

An app cannot create branches or commits, push, start or cancel CI, or
administer or delete repositories. Repository rules apply to everything it
does.

A merge request returns `accepted` before the merge finishes. Have the app
check the merge status until it reports `completed` before it assumes the pull
request merged.

## Review or revoke access

Open **Settings → Authorized Apps** to see each app's repositories, permissions
and expiry. Choose **Revoke access** and confirm to end a connection
immediately.

A connection lasts 30 days. To add a repository or continue after it expires,
connect again from the client.

## Connect an API client

OAuth clients can also call the [REST API](https://git.cafe/docs/reference/api.md). Use
`https://git.cafe/api` as the OAuth resource; a token issued for the API does
not work for MCP, and the reverse is also true. Consent screens and
**Authorized Apps** label the two as **API access** and **MCP access**.

- Use the authorization-code flow with PKCE (`S256`), and send the `/api`
  resource in the authorization, token and refresh requests.
- Access tokens last up to 15 minutes. Each refresh returns a new refresh token
  valid for up to seven days. The connection ends after 30 days.
- API OAuth covers repository operations on the selected repositories. It does
  not grant organization, team or profile access, or Git credentials.
- To revoke a token, send it with the connection's `client_id` to the
  revocation endpoint.

For the other ways to authenticate, see
[choose how to authenticate](https://git.cafe/docs/agent-workflows.md#choose-how-to-authenticate).

## Connect an agent using auth.md

An agent without a registered OAuth client can connect through the flow
described at `https://git.cafe/auth.md`. It grants REST API access for up to one
hour; it does not grant MCP or Git access.

1. Give the agent your GitCafe account's email address. The agent registers and
   shows you a verification link and a six-digit code.
2. Open the link, sign in, and enter the code. Only continue if you asked the
   agent to connect.
3. Select repositories and permissions, then approve. Write and admin
   permissions start off.

The code expires after ten minutes and locks after five wrong attempts. Access
tokens last 15 minutes and the agent can renew them until the connection ends
after one hour. For longer access, use API OAuth, MCP or the CLI instead.

To stop the agent, revoke **Agent registration (auth.md)** in **Settings →
Authorized Apps**.