Source
Start your library
Documentation

Connect your agent

source://docs/mcp.md

Source speaks MCP over streamable HTTP at https://usesource.dev/mcp. Every capability is an MCP tool — the same operations as the REST API, generated from the same registry, so the two surfaces never drift.

Claude Code#

Create an API key on your account page, then:

claude mcp add --transport http source https://usesource.dev/mcp --header "Authorization: Bearer src_live_..."

Run /mcp inside Claude Code to confirm the connection. The server sends instructions at initialize, so a first prompt like "write today's decisions to my source library" is enough — the agent finds list_libraries and write_file on its own.

Claude Desktop and claude.ai#

Add Source as a custom connector:

  1. Settings → Connectors → Add custom connector.
  2. Name it source, set the URL to https://usesource.dev/mcp.
  3. Click Authenticate. Your browser opens the Source consent page: sign in, choose or create an agent identity, and pick the scope it may act in — a library, a path prefix, and a role.

The token Claude receives is bound to that agent identity and that scope. The agent it powers appears in provenance lines and the audit log under its own name, not yours.

API keys or OAuth?#

Both arrive as Authorization: Bearer and resolve to an agent principal. Choose by how the credential is managed:

API key OAuth
Best for CLIs, CI, scripts, anything headless Claude Desktop, claude.ai, clients with an Authenticate button
Issued by You, on the account page The consent flow, per client
Scope The agent identity's grants Chosen at consent: library + path prefix + role
Lifetime Until you revoke it Short-lived access token, rotating refresh token

Rule of thumb: if you would paste the credential into a config file, use an API key. If the client can open a browser, use OAuth.

For MCP client implementers#

Discovery follows the MCP authorization spec:

  1. An unauthenticated request to https://usesource.dev/mcp returns 401 with a WWW-Authenticate header pointing at the protected resource metadata (RFC 9728): https://usesource.dev/.well-known/oauth-protected-resource.
  2. That metadata names the authorization server; its metadata is at https://usesource.dev/.well-known/oauth-authorization-server.
  3. Register a client dynamically, then run authorization code + PKCE (S256). The human signs in and binds the token to an agent identity and scope on the consent page.
  4. Send the access token as a Bearer token on every MCP request. Tokens are audience-bound to https://usesource.dev/mcp and short-lived; refresh tokens rotate on use.

Server instructions#

At initialize, Source sends server instructions describing the library model: paths like /folder/file.md, section addressing by slug path or ordinal, allow-only permissions, soft deletes, and where to start (list_libraries, then list_tree). Agents that have never seen Source get oriented without any custom prompting — the same material as llms.txt.

source://docs/mcp.md