Sign InGet Started

Registering Custom MCP Clients

Register a third-party MCP client application so it can authenticate against Hamster's MCP server with its own OAuth client ID.

Overview

Most AI coding tools — Claude Code, Cursor, Windsurf, Codex — register with Hamster's MCP server automatically and only need the server URL (see Getting Started).

Custom or third-party MCP client applications that can't self-register need a pre-registered OAuth client instead. If you have the connections.manage permission, you can register one from Workspace Settings → MCP integrations, and Hamster issues a public PKCE client ID (no client secret) that your app uses to authenticate. The resulting normal OAuth session can discover all 39 full-scope tools.

Register a New Client

  1. Open Workspace Settings → MCP integrations.
  2. Click Register a new client application.
  3. Provide:
    • Application name — a human-readable name for your MCP tool (e.g. "My Research Agent").
    • Exact HTTPS redirect URIs — one or more HTTPS URLs where your client receives auth callbacks (e.g. https://my-agent.example.com/auth/callback).
  4. Click Register.
  5. Hamster generates a public PKCE client ID. Use it in your MCP tool's configuration — there is no client secret; PKCE handles token exchange securely.

Manage Registered Clients

Registered clients appear in the Registered Applications list, where you can:

  • View client details — the client ID, redirect URIs, and creation date.
  • Edit registration — add or remove redirect URIs. The application name is fixed at registration.
  • Revoke registration — block new authorizations and immediately invalidate the client's existing sessions and tokens.

How Custom Clients Authenticate

Once registered, your client follows the same OAuth 2.1 PKCE flow as any MCP tool:

  1. It follows Hamster's protected-resource metadata to the OAuth authorization server.
  2. It opens your browser to sign in with your Hamster credentials.
  3. You approve the connection.
  4. Hamster redirects back with an authorization code, which the client exchanges with its PKCE verifier for tokens.

Normal OAuth calls run as the signed-in user and respect that user's account role and permissions — a Reviewer's client can read but not create Briefs, while a user with write permission can use the corresponding create and update tools. Hosted delivery credentials use a separate eight-tool surface bound to one delivery job and one Brief or Task. Registering a client does not grant any admin override at the MCP layer.

Related

  • MCP Server — connect your AI coding tool to Hamster
  • Getting Started — the standard auto-registration flow
  • Available Tools — the 39-tool full scope, eight-tool hosted delivery scope, and 35 CLI/MCP pairs plus four MCP-only tools