# Get Started with MCP > Set up the Done Bear MCP server in Claude Desktop, Claude Code, Cursor, VS Code, Codex, and other clients. Connect your AI coding assistant to Done Bear's hosted MCP server. Authentication happens automatically via OAuth, so the normal flow does not require a local npm package, API key, or CLI install. First-party plugin packaging lives in this repo at `apps/plugins`. Cursor and Grok Bot share one marketplace plugin; Claude and ChatGPT have their own. Each package points at the same hosted endpoint below. Until those listings are approved, add the connector by URL as on this page. ## Before you begin - Create a Done Bear account at [donebear.com](https://donebear.com), or from a coding agent with `donebear auth signup --email ` (the human verifies the email; do not invent one). ## Endpoint ```text https://mcp.donebear.com/mcp ``` ## One-click install If your editor supports MCP deeplinks, install Done Bear without editing any config: - **Cursor:** [Add Done Bear to Cursor](cursor://anysphere.cursor-deeplink/mcp/install?name=donebear&config=eyJ1cmwiOiJodHRwczovL21jcC5kb25lYmVhci5jb20vbWNwIn0=) - **VS Code (Copilot):** [Add Done Bear to VS Code](vscode:mcp/install?%7B%22name%22%3A%22donebear%22%2C%22type%22%3A%22http%22%2C%22url%22%3A%22https%3A%2F%2Fmcp.donebear.com%2Fmcp%22%7D) For Claude, ChatGPT, and everything else, add the server manually below, or install the matching first-party plugin from `apps/plugins` once it is listed. ## Add the server to your client ### Claude Desktop Open Settings → Connectors, add a custom connector, and enter: ```text https://mcp.donebear.com/mcp ``` ### Claude Code ```bash claude mcp add --transport http donebear https://mcp.donebear.com/mcp ``` Run `/mcp` in a Claude Code session to verify the connection. ### Codex ```bash codex mcp add donebear --url https://mcp.donebear.com/mcp ``` If this is your first remote MCP in Codex, enable the remote client in `~/.codex/config.toml`: ```toml [features] experimental_use_rmcp_client = true ``` Then run: ```bash codex mcp login donebear ``` ### Cursor Add to `.cursor/mcp.json` in your project or `~/.cursor/mcp.json` globally: ```json { "mcpServers": { "donebear": { "url": "https://mcp.donebear.com/mcp" } } } ``` ### VS Code (Copilot) Add to `.vscode/mcp.json` in your project: ```json { "servers": { "donebear": { "type": "http", "url": "https://mcp.donebear.com/mcp" } } } ``` ### Windsurf Add to your MCP config: ```json { "mcpServers": { "donebear": { "serverUrl": "https://mcp.donebear.com/mcp" } } } ``` ### ChatGPT On a Plus, Pro, or Team (and up) plan, open Settings → Developer mode → Apps & Connectors → Add, and enter: ```text https://mcp.donebear.com/mcp ``` ### Others Any MCP client that supports Streamable HTTP transport can connect directly to: ```text https://mcp.donebear.com/mcp ``` ## Verify it works After adding the config, restart your client. Ask the assistant something like: > "List my Done Bear tasks" On the first request, your client will open a browser window for you to sign in to Done Bear, then approve the connection on a Done Bear page that shows where it sends access. After that, authentication is automatic. ## Authentication The MCP server is an OAuth 2.1 resource server, pinned to the [2025-11-25 authorization spec](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization). The live connect flow is: 1. Client POSTs `initialize` (and may `tools/list`, `ping`, `notifications/initialized`, or an empty inspect body) to `https://mcp.donebear.com/mcp` without a token. Directories and ChatGPT Scan Tools get **200** and the tool schemas. Grok Bot and Cursor (`User-Agent` or `clientInfo.name` matching `grok` / `xai` / `cursor`) get **401** on `initialize` and `tools/list` with `scope="read write"` so they start one OAuth grant instead of treating the public handshake as no-auth. 2. `tools/call` without a token returns **401** with `WWW-Authenticate` and `resource_metadata=` pointing at the path-scoped protected-resource document. Read tools advertise `scope="read"`; write tools (for example `task_add`) advertise `scope="read write"` so a host can finish OAuth in one grant. Empty bodies, missing methods, and unknown methods do not 401. 3. Client fetches protected resource metadata, then authorization-server metadata. 4. Client identifies itself with a **Client ID Metadata Document** (an HTTPS URL as `client_id`). A document’s HTTPS redirects must be on the host that serves it; loopback redirects are also accepted. Dynamic Client Registration at `/register` is a deprecated fallback, slated for removal after summer 2027. It accepts only loopback addresses and the redirects of known clients: ChatGPT, Claude, Cursor, Grok and VS Code. Anything else gets `invalid_client_metadata`. 5. User signs in, then approves the client on `mcp.donebear.com`, which shows the client’s name, ID and redirect host. No authorization code is issued without that approval. The client receives a short-lived MCP access token (and a refresh token for public clients). 6. Client calls `tools/list` or `tools/call` with `Authorization: Bearer `. A session is optional: authenticated `initialize` still mints one, but authenticated one-shot requests work without `Mcp-Session-Id`. 7. Session-less `GET /mcp` opens a **200** `text/event-stream` stream, with or without `Authorization`. Unauthenticated `DELETE /mcp` is a **200** no-op (ChatGPT Scan Tools tears down the inspect session this way). `GET` with a valid `Mcp-Session-Id` still requires a bearer and opens the session stream (Fly replay unchanged). A bad bearer on GET or DELETE is still **401**. Write tools require the `write` scope. A valid read-only token that calls a write tool gets **403** `insufficient_scope` rather than another 401. Clients that support a static bearer can also send a Done Bear API key on every request. To see which clients are connected to your account, open **Settings → MCP** in the web app. Disconnect one there to remove its access straight away; it will need to sign in again to reach your tasks. A client may keep working for up to a minute while its access winds down. ## Troubleshooting | Problem | Fix | | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | "Not authenticated" | Reconnect the server and repeat the OAuth flow. | | Server not appearing | Check the config file path and restart your client. | | 0 tools / `failed_to_load` | Clear saved MCP auth and reconnect. After sign-in the client should send `initialize` or `tools/list` with the access token; a session header is not required to load the tool list. Session-less `GET /mcp` is 200 SSE, with or without a bearer — not 400, 401, or 405. | | "Multiple workspaces found" | Pass `workspace` to tools, or reconnect and pick a default workspace on the approval page. API keys have no default; the error names the workspaces to choose from. | | Old saved auth keeps failing | Clear your client's saved MCP auth state, then reconnect the Done Bear MCP. | | Stop a client's access | Disconnect it from **Settings → MCP** in the web app. | ## Next steps - Read [MCP overview](/mcp) for the current tool surface. - Read [CLI overview](/cli) for the terminal workflow. - Read [API overview](/api) if you are building a custom integration. --- Every Done Bear page is listed at https://donebear.com/llms.txt. Any page has a markdown copy at its URL plus `.md`. Start from the map rather than guessing a path.