> ## Documentation Index
> Fetch the complete documentation index at: https://mcp-docs.cohesive.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Other clients

> Connect any MCP client to mcp.cohesive.ai through the Cohesive sign-in.

Every client connects the same way Claude does: it points at `https://mcp.cohesive.ai/mcp`, discovers where to sign in, and sends you to Cohesive. You sign in there, and the client is scoped to you and your organization from then on. There's no credential to paste and nothing to copy between the two.

## What a client needs

* **Streamable HTTP.** The transport is [Streamable HTTP](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports), and the server is stateless — no session to open, keep alive, or resume.
* **OAuth 2.1 with PKCE (S256)**, following the `WWW-Authenticate` challenge to the resource metadata and on to the authorization server.
* **A client ID metadata document.** The server doesn't offer dynamic registration. A client identifies itself with a `client_id` that is a URL to a JSON document listing its redirect URIs.
* **An allowlisted origin.** Both the `client_id` origin and the redirect URI origin have to be on the server's allowlist, which is what keeps sign-in to clients Cohesive has admitted. To get a client added, write to [support@cohesive.ai](mailto:support@cohesive.ai).

## Configure it

Most clients need one thing — the URL:

```
https://mcp.cohesive.ai/mcp
```

The first request comes back `401`, the client follows the challenge, and the sign-in opens in a browser. To mount a specific set of toolsets, put the selection in the path: `https://mcp.cohesive.ai/mcp/x/canvas,file`. See [Toolsets](/connect/toolsets).

## What the client discovers

Both documents are public, so you can read exactly what your client will:

```bash theme={null}
curl https://mcp.cohesive.ai/.well-known/oauth-protected-resource/mcp
curl https://mcp.cohesive.ai/.well-known/oauth-authorization-server
```

The first names the resource and points at the authorization server. The second gives the authorize and token endpoints, the supported grants — `authorization_code` and `refresh_token` — and `client_id_metadata_document_supported`, which is the flag a client reads to know it should use its metadata document rather than register.

## Long calls stay open

A capture can run for minutes. While a tool is still working, the response stream carries SSE comments about every 30 seconds, which keeps intermediaries from closing an idle connection. Comments are ignored by every SSE parser, so a client needs no special handling — it just shouldn't impose a short read timeout.

## Other details worth knowing

|                     |                                                                                               |
| ------------------- | --------------------------------------------------------------------------------------------- |
| Health check        | `GET https://mcp.cohesive.ai/healthz` returns status and version, no sign-in                  |
| Request body limit  | 8 MiB                                                                                         |
| Not signed in       | `401` with `WWW-Authenticate: Bearer realm="cohesive"` and a pointer to the resource metadata |
| Client not admitted | `403` at the authorization endpoint, when the origin isn't allowlisted                        |
| Unknown toolset     | `400` with the name that wasn't recognized                                                    |

For what the sign-in grants and what it withholds, see [Authentication](/reference/authentication).