CorpusIQ exposes one remote MCP server. An agent, a CLI or a desktop client points at a single URL, discovers the OAuth metadata, signs in, and receives a bearer token. There is no SDK to install and no separate build step to ship your own tool against it. This page covers the endpoint, the two auth paths, and exactly what the read-only guarantee does and does not permit.
The endpoint
Add one URL to your client configuration: https://mcp2.corpusiq.io/mcp. The transport is streamable HTTP, compatible with any MCP client SDK that supports remote HTTP servers.
Send POST requests with Content-Type: application/json and Accept: application/json, text/event-stream. A GET on the bare endpoint returns 406 by design, because the server expects a protocol request rather than a browser visit. That is not an outage.
Once authenticated, the server exposes the connector tools behind 40+ connectors and 500+ tools. Tools are namespaced by source, so a client can list what is available before calling anything.
Auth path A: browser clients
Spec-compliant clients discover the authorization server from the well-known metadata document and open a sign-in window. The user signs in on CorpusIQ, approves the request, and the client receives a token without ever handling a password.
Nothing to implement beyond following the discovery document. This is the path ChatGPT, Claude and Perplexity use when you add CorpusIQ as a connector.
Auth path B: CLI tools and agents
Headless clients use the OAuth device authorization flow. Request a device code, show the short code and verification link to the user, poll for completion, then exchange for a JWT.
Send the JWT as an Authorization: Bearer header on every MCP request. Access tokens are short lived, so a long-running agent refreshes with the refresh token rather than re-prompting a human. Store the refresh token the way you store any credential: outside the repository, outside logs.
The discovery document publishes the exact authorization, token and device authorization endpoints, so read them at runtime rather than hardcoding paths that may change.
The read-only guarantee, precisely
External retrieval is read-only. Every tool that reads a connected system reads it. It cannot create, update or delete a record, send a message, or move money. There is no write scope to request and none to grant.
Configuration controls are separate and deliberately narrow. Enabling a connector, disabling it, selecting a primary account or resetting an expired token write scoped platform state belonging to your CorpusIQ account. They do not write to the systems you connected.
That distinction is the one worth testing in a review: retrieval touches your business records, configuration touches our record of your connection, and the two do not cross.
What to expect on the wire
- →Requests are JSON-RPC over HTTP. Responses may stream as server-sent events depending on the Accept header.
- →Every tool call carries the identity of the authorized account. There is no shared service account and no impersonation path.
- →Tool results include the source reference for each figure, so a caller can attribute rather than assert.
- →Rate limits and quotas are applied per account. If you need headroom for a workload, ask before you build against the assumption of unlimited calls.
- →Direct MCP does not retain raw customer files or full connector response payloads. Operational query text, per-user tool-call metadata and bounded outcome summaries may be retained for up to 30 days.
Designing a tool on top of it
The useful pattern is a narrow agent, not a general one. Give it one job, one source and one output shape: an invoice chaser that reads receivables and drafts the reminder, an ops digest that reads three systems every Monday and posts four numbers.
Ask for the citation, not just the value. A tool that returns a figure without its source is a tool whose output nobody can defend in a review, and defensibility is the reason to build on a cited data layer instead of raw API calls.
Keep the question list short and stable. The agent gets reliable when its inputs are predictable, and the same rule that makes a human question good makes an agent prompt good.
Common questions
Do I need an SDK?
No. The server speaks standard MCP over streamable HTTP with OAuth discovery, so any MCP client library that supports remote servers can connect. Use the SDK you already have.
Can my agent write to the connected systems?
No. External retrieval is read-only by design. There is no write scope for business records. Configuration controls write only scoped platform state on the CorpusIQ account, such as enabling a connector.
How long does a token last?
Access tokens are short lived and refreshed with a refresh token. Build the refresh into the client rather than prompting a user every hour, and treat the refresh token as the credential worth protecting.
Is there a sandbox?
The trial account is the environment: connect a source, exercise the tools, and verify against numbers you can check by hand. Ask about dedicated environments if you are building something that needs isolated data.
Where is the API reference?
The docs site carries the endpoint walkthrough, the device login helper and the client configuration examples for several agent frameworks. The discovery document is the authoritative list of live endpoints.
Try CorpusIQ Free
Point your client at one URL and test it
30-day free trial. Cancel anytime. All 40+ connectors included.
Start free trial →