Sign InGet Started

MCP Server

Give AI coding tools direct access to your Briefs, Tasks, and project context through the Model Context Protocol. The Hamster plugin configures hosted MCP. No API keys.

Overview

The Hamster MCP Server lets Claude Code, Cursor, Windsurf, Codex, and other MCP clients work with live Hamster context. Full user sessions can search the workspace, inspect accounts and members, read and write Briefs, Tasks, notes, Initiatives, and subtasks, read Goals, documents, Plans, and knowledge-graph relationships, ask Hamster a workspace question, generate Plans, and trigger delivery.

The usual path is the Hamster plugin. The plugin configures hosted MCP at https://tryhamster.com/mcp, and your client follows a standard OAuth sign-in the first time you use it. Subsequent calls are automatic.

The server exposes 39 tools covering search, accounts, members, Briefs, Tasks, subtasks, Initiatives, Goals, documents, Plans, Delivery, notes, chat, and the Context Graph. All access goes through your authenticated session and respects the same permissions you have in the browser. There are no admin keys involved — every call runs as you, scoped to your team's data.

Hosted delivery receives a separate eight-tool surface bound to one delivery job and one delivery resource — a Brief or Task. Of the 39 full-scope tools, 35 have CLI counterparts and four are MCP-only: get_hamster_reply, search_knowledge_graph, explore_entity, and get_neighborhood. Every call follows the account permissions or job-and-resource scope of its credential.

What's in this section

How Authentication Works

Hamster's MCP Server uses OAuth 2.1 — the same standard your IDE already speaks. The first time your AI tool calls a Hamster tool:

  1. The tool sees that it needs to authenticate and looks up Hamster's OAuth configuration via a discovery endpoint at /.well-known/oauth-protected-resource. This is a public, machine-readable record that tells the tool where to send you for sign-in.
  2. The tool opens your browser to Hamster's consent page.
  3. You sign in (or confirm if you are already signed in) and approve the connection.
  4. The browser returns an authorization code to your AI tool, which exchanges it (with a PKCE verifier) for tokens.
  5. Every subsequent call runs as you, with your team-account permissions enforced server-side.

Most AI tools handle this flow automatically — you just see the browser pop open the first time. If your tool does not support automatic OAuth discovery, you can still paste a Bearer token manually.

The MCP Server never holds an admin key or service-role credential. Every tool call carries your token, which means a Reviewer cannot accidentally edit a Brief from inside their AI assistant just because the assistant tried to.

Related