Guides
Connect an AI client with MCP
Grant an AI client access to a workspace using OAuth, with the same resource permissions as its member.
Copy the connector URL
In Squario, open Account → Connected apps and copy the MCP server URL. Add it as a remote or custom MCP server in a client that supports remote OAuth servers. The URL ends in /functions/v1/mcp-server/mcp; it is different from the REST API base URL. Use the URL shown in the app.
- The client discovers the server, registers itself and opens the consent screen.
- Sign in, choose the workspace and approve the grant.
- The client receives OAuth tokens and discovers the available tools.
- Revoke the connection from Account → Connected apps at any time.
A grant acts as you
MCP uses OAuth 2.1 with PKCE, not a member API key. Its tokens bind one member to one workspace. Membership, squaria.mcp, record visibility and field permissions are rechecked on each call. Access tokens last one hour; refresh tokens last 30 days and rotate on use. The client should manage that lifecycle.
Discover, validate, then write
Start with describe_resource or describe_capabilities, then read the records you need. Use validate_change before a write. Tools are parameterised by resource and certified against the workspace’s schema.
| Purpose | Examples |
|---|---|
| Records | list_records, get_record, resolve_reference, global_search |
| Discovery | describe_resource, describe_capabilities, list_data_models, list_custom_fields |
| Changes | validate_change, create_record, update_record, archive_record, restore_record |
| Workspace context | list_forms, list_drive_items, list_audit_log, knowledge tools |
| Views and reports | list_views, save_view, save_structural_view, run_report |
Approval, credits and limits
Use your client’s tool-approval controls for writes. MCP calls spend workspace AI credits rather than the REST request allowance; a failed tool call is refunded. A repeated invocation is a new call and a new charge. Default tool limits are 60/minute and 1,000/hour per member and workspace. A throttled request returns 429 with Retry-After.
- Drive tools expose metadata, never file contents.
- MCP does not expose the in-app page navigation and detail-layout actions.
- Available tools can change with the server release. Use the client’s tool discovery as the contract.