DE

Kepos · MCP

Connect Claude Desktop to Kepos via MCP — Kepos

Connect Claude Desktop to Kepos through its remote OAuth connector, review scoped access, and register the agent before using shared knowledge.

What you need

  • A Kepos account with access to at least one Space.
  • A browser session for Kepos sign-in and the OAuth consent screen.
  • Claude Desktop with Settings → Connectors → Add custom connector available in your installation.

Set up Claude Desktop

  1. 1

    Open Connectors in Claude Desktop

    Open Settings → Connectors and choose Add custom connector. Remote MCP servers are added through this connector UI, not through a local mcpServers JSON entry.

  2. 2

    Enter the Kepos URL

    Enter https://kepos.app/mcp as the custom connector URL and continue.

  3. 3

    Complete the Kepos OAuth consent

    Kepos sends you to login when no Kepos session is available, then shows the requesting client and a consent screen. The screen offers the full scope surface: requested scopes start selected, other scopes are shown unselected, Spaces can be limited when more than one is available, and Vaults default to all accessible Vaults or can be restricted to individual Vaults. Choose the permissions you want and approve.

  4. 4

    Reconnect and test

    Finish the OAuth redirect, save the connector, and reconnect it in Claude Desktop. Then run the onboarding test below.

Run the first function test

After the connection is visible, let the agent read the onboarding prompt and register itself. The registration response includes the session identity and workspace match when one is found.

prompts/get { "name": "agent-onboarding" }
tools/call {
  "name": "chat_register",
  "arguments": { "host_hint": "your-client", "model_hint": "your-model",
    "workspace_fingerprint": { "secondary": { "repo_basename": "your-repo" } } }
}

Troubleshooting

401 Unauthorized or an authentication error

Check that the Authorization header is exactly Bearer followed by the complete mn_ token. Create or revoke tokens in /me/mcp-tokens; the token secret is shown only once. An OAuth client should complete discovery and authorization again instead of copying a manual token into its flow.

428 ONBOARDING_REQUIRED

The server requires the agent-onboarding prompt and a chat_register call before productive work. Use prompts/get with name agent-onboarding (or resources/read with brain://prompts/agent-onboarding), then call chat_register with a workspace_fingerprint. Tool-only clients can call read_onboarding.

412 SEARCH_FIRST_REQUIRED when creating a note

Call search_notes before create_note in the same session. This is a server-enforced workflow rule, not a client configuration problem.

Manual token alternative

For clients that support Authorization headers, you can create a scoped token in /me/mcp-tokens instead. The Claude Code and Cursor guides show that manual configuration path.

The connector UI and its menu labels are client-side details. The Kepos endpoint, OAuth discovery, consent scope behavior, bearer authentication, and onboarding are implemented in this repository.