> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbitforms.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP Server

> Connect AI assistants like Claude to your OrbitForms account using the Model Context Protocol (MCP).

OrbitForms ships a built-in [Model Context Protocol](https://modelcontextprotocol.io) server, so AI assistants and agents can read and act on your contacts, forms, submissions, meetings, scheduling pages, email sequences, and webhooks — scoped to your team and gated by the same scopes and rate limits as the REST API.

## Endpoint

```
https://orbitforms.ai/api/mcp
```

The server uses the Streamable HTTP transport (the current MCP standard). SSE-only clients are not supported.

## Connect with OAuth (recommended)

The server supports the full MCP authorization flow — OAuth 2.1 with PKCE, dynamic client registration, and automatic discovery. Add the connector and your client walks you through login and consent in the browser; no keys to copy, tokens refresh automatically, and you can revoke access at any time.

<Tabs>
  <Tab title="Claude Code">
    ```bash theme={null}
    claude mcp add --transport http orbit https://orbitforms.ai/api/mcp
    ```

    Then run `/mcp` inside Claude Code and choose **Authenticate** — your browser opens to the OrbitForms consent screen.
  </Tab>

  <Tab title="Claude Desktop / claude.ai">
    Add a custom connector with URL `https://orbitforms.ai/api/mcp` and click **Connect**. You'll be taken to OrbitForms to sign in, pick a team, and approve the requested scopes.
  </Tab>

  <Tab title="Cursor">
    Add to `.cursor/mcp.json` — Cursor detects the OAuth server and prompts you to log in:

    ```json theme={null}
    {
      "mcpServers": {
        "orbit": {
          "url": "https://orbitforms.ai/api/mcp"
        }
      }
    }
    ```
  </Tab>
</Tabs>

During consent you choose which team the assistant may access; every tool call is scoped to that team. Access is revocable from your account settings, and dynamically registered clients are limited to non-destructive scopes (no delete or team-management permissions).

## Connect with an API key

For headless use — scripts, CI, server-side agents — authenticate with an OrbitForms API key instead, created in **Developer Portal → API Keys**. Pass it either way:

```
Authorization: Bearer sk_live_...
```

```
X-API-Key: sk_live_...
```

For example, in Claude Code:

```bash theme={null}
claude mcp add --transport http orbit https://orbitforms.ai/api/mcp \
  --header "Authorization: Bearer sk_live_YOUR_KEY"
```

<Tip>
  If you use API keys, create a dedicated key for each assistant with only the scopes it needs — read-only scopes are a good default. You can revoke it any time from the Developer Portal without affecting other integrations.
</Tip>

## Scopes

Each tool requires a specific scope (for example `contacts:read` for `list_contacts`, `sequences:write` for `enroll_contacts_in_sequence`). With OAuth you approve scopes on the consent screen; with API keys you pick them at key creation. Calls made with a credential missing the scope return an `insufficient_scope` error naming the scope to add. All data access is scoped to the team that owns the credential.

See [Available Tools](/mcp/tools) for the full tool list, required scopes, and the meeting-booking flow.