Skip to main content
Every client connects the same way Claude does: it points at https://mcp.cohesive.ai/mcp, discovers where to sign in, and sends you to Cohesive. You sign in there, and the client is scoped to you and your organization from then on. There’s no credential to paste and nothing to copy between the two.

​
What a client needs

  • Streamable HTTP. The transport is Streamable HTTP, and the server is stateless — no session to open, keep alive, or resume.
  • OAuth 2.1 with PKCE (S256), following the WWW-Authenticate challenge to the resource metadata and on to the authorization server.
  • A client ID metadata document. The server doesn’t offer dynamic registration. A client identifies itself with a client_id that is a URL to a JSON document listing its redirect URIs.
  • An allowlisted origin. Both the client_id origin and the redirect URI origin have to be on the server’s allowlist, which is what keeps sign-in to clients Cohesive has admitted. To get a client added, write to support@cohesive.ai.

​
Configure it

Most clients need one thing — the URL:
The first request comes back 401, the client follows the challenge, and the sign-in opens in a browser. To mount a specific set of toolsets, put the selection in the path: https://mcp.cohesive.ai/mcp/x/canvas,file. See Toolsets.

​
What the client discovers

Both documents are public, so you can read exactly what your client will:
The first names the resource and points at the authorization server. The second gives the authorize and token endpoints, the supported grants — authorization_code and refresh_token — and client_id_metadata_document_supported, which is the flag a client reads to know it should use its metadata document rather than register.

​
Long calls stay open

A capture can run for minutes. While a tool is still working, the response stream carries SSE comments about every 30 seconds, which keeps intermediaries from closing an idle connection. Comments are ignored by every SSE parser, so a client needs no special handling — it just shouldn’t impose a short read timeout.

​
Other details worth knowing

For what the sign-in grants and what it withholds, see Authentication.