Docs
← Back to Docs
Last updated: 2026-09-13

MCP Access

InvyMate's read-only MCP integration lets MCP-compatible AI clients (i.e. Claude or Codex) answer questions about the assets in your workspace without giving those tools permission to change your data.

What it is

MCP (Model Context Protocol) connects an MCP-compatible AI client to a small, read-only InvyMate toolset. It is intended for questions such as “Which assets are assigned to this person?” or “Who has had this asset, and when?”

Who can use it

MCP access is granted per user. An Owner must enable it for the individual InvyMate user who will connect a client. Admins cannot manage this flag.

The user must also be active and working in the correct workspace. MCP access is separate from API keys; enabling one does not create or grant the other.

Enable access for a user

An Owner can enable MCP access for an existing member:

  1. Open Configuration → Team.
  2. Find the member and choose Edit.
  3. Turn on Allow MCP access.
  4. Save the member.

Repeat these steps to disable access for that user.

Connect Codex

Use your workspace subdomain in the MCP URL:

https://<workspace>.invymate.com/mcp

In a terminal, register the remote MCP server with Codex:

codex mcp add invymate --url https://<workspace>.invymate.com/mcp
codex mcp login invymate

Complete the login and consent steps in your browser. Check the configured server with:

codex mcp list

Connect Claude Code

In a terminal, add the remote HTTP MCP server:

claude mcp add --transport http invymate https://<workspace>.invymate.com/mcp

Start Claude Code and run /mcp, then choose InvyMate and follow the browser login and consent steps. Check the server configuration with:

claude mcp list

Connect another MCP-compatible client

Clients that support remote HTTP MCP and OAuth can use the same workspace URL:

https://<workspace>.invymate.com/mcp

Add the URL as a remote MCP server and follow the client's browser login and consent flow.

The OAuth flow authenticates the individual InvyMate user. The client stores the connection credentials and may refresh them according to its own OAuth support.

Do not use the old dedicated mcp.invymate.com host.

Available tools

The integration exposes exactly two tools:

  • assets_by_person — find a person's current assigned assets.
  • asset_custody_history — find who has or had an asset, including assignment intervals. The current assignment has no end time.

Read-only boundaries

MCP can read the supported asset, person, assignment, and custody-history data needed by these tools. It cannot create, update, or delete records; export data; perform admin actions; proxy arbitrary API requests; create API keys; or use API keys as MCP credentials.

The InvyMate API remains the tenant and security authority. A request is denied when the user is inactive, Allow MCP access is disabled, the token is invalid, expired, or revoked, or the token's tenant or host context does not match the request.

Tenant, permissions, and token lifecycle

Each MCP request is evaluated for the authenticated user and the workspace in the connection context. A user's MCP access does not extend to another workspace, and it does not elevate the user's normal permissions.

The bearer token belongs to one user. Keep it secret. An Owner can disable Allow MCP access to stop MCP requests for that user immediately while the flag is disabled; this does not permanently revoke the token record, and re-enabling access can allow an otherwise valid, unexpired token again. Disabling MCP access does not change API-key access. If a token expires or is otherwise invalid, the user must reauthorize through the configured MCP flow to issue a new token. This integration does not promise refresh-token behavior.

Disabling Allow MCP access blocks MCP access while disabled. Reauthorization or issuing a new token is needed when the existing token expires or is otherwise invalid.

Troubleshooting

The client cannot connect

  • Confirm the selected package or client is configured for remote HTTP MCP.
  • Check that it is using the deployment-provided MCP resource URL.
  • Check that it is connected to the correct workspace and host for the user.

The token is rejected

Ask an Owner to confirm that the user is active and Allow MCP access is enabled in Configuration → Team. If access is correct, reauthorize the client through the configured MCP authorization flow to obtain a new token.

A tool returns no results or the wrong workspace

Verify the person or asset identifier, the workspace, and the host context. If the token is expired or otherwise invalid, reauthorize the client to obtain a new token. MCP does not bypass tenant isolation or return data from a different host context.

I need to change data or run an export

Use the InvyMate application or the separately managed API Access integration. MCP is intentionally limited to the two read-only tools above.

← API AccessAPI Endpoints (Overview) →