Skip to main content
Claude connects to Cohesive as a custom connector over OAuth. You sign in once in a browser, and Claude keeps the result for you.

​
Add the connector

1

Open connector settings

In Claude.ai or Claude Desktop, go to Settings → Connectors and choose Add custom connector.
2

Enter the server URL

To mount a specific set of toolsets instead of the default, put the selection in the path — https://mcp.cohesive.ai/mcp/x/canvas,file. See Toolsets.
3

Sign in

Claude sends you to Cohesive’s sign-in page. Approve the connection and the tab returns you to Claude.
4

Confirm

Call cohesive_info. It names the user and organization the tools will act as, and lists the toolsets that got mounted.

​
What the sign-in does

The server is its own authorization server. It presents the OAuth metadata Claude looks for, then brokers the real sign-in to Cohesive on your behalf, so Claude never talks to the identity provider directly.
  • Authorization code with PKCE (S256), and refresh tokens, so a connection outlives a single access token.
  • No dynamic client registration. The server admits a client by its Client ID Metadata Document — the client_id is a URL to a document listing the client’s redirect URIs, and both origins have to be on the allowlist. That keeps the connector to Claude-family clients.
The metadata is public if you want to read it:

​
What the connection can do

Tools run as you, under a short-lived token minted for this session. That token carries your own access to the organization and withholds credential management, so an agent on this connector can’t create, list, or revoke credentials for your account. Authentication covers the model in full.

​
Troubleshooting

The session behind the connector expired or was revoked. Reconnect from Settings → Connectors. The server drops its cached exchange as soon as a tool call comes back with an authentication error, so a revoked session stops working immediately rather than at the end of an hour.
A toolset name in the URL isn’t one the server knows. Unknown names are rejected outright rather than ignored — check the spelling against Toolsets.
Other clients sign in the same way, but the server only admits a client whose client_id and redirect URI origins are allowlisted. See Other clients for what a client needs and how to get one added.