Authorization

Every request to the MCP server carries an Authorization: Bearer header. What the token is decides who the assistant acts as.

	Sign in with Monotree (OAuth)	API token
Header	OAuth access token issued by Monotree	`mono_` token from the CMS
Acts as	The signed-in person	The admin who created the token, or the system user
Who can use it	Admins, global and group editors, managers	Anyone holding the token
Visibility	The person's CMS visibility: managers and group editors see their own groups	Company-wide, limited by the token's scopes
Tools offered	Filtered by role	Filtered by scope
Typical client	Claude, ChatGPT, Gemini	Claude Code, Cursor, scripts
Revoke	CMS → Open API → MCP, or remove in the client	CMS → Open API → API Tokens

Signing in with Monotree

The server implements OAuth 2.1 with PKCE and dynamic client registration, so supported clients configure themselves from the URL. Discovery documents are published at /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server.

Only admins, editors and managers can approve a connection. Other employees see a message that their role does not permit connecting AI clients.
The role check runs on every request. If a person loses their role, their assistant loses access immediately.
Access tokens last 12 hours and refresh automatically. A connection that goes unused for 90 days expires.
One OAuth scope exists, mcp:use. What the assistant can do is decided per tool by the person's role.

Automatic registration accepts callback URLs on claude.ai, claude.com, chatgpt.com, chat.openai.com, gemini.google.com and http://localhost. Other domains are rejected; see Connect a client.

Using an API token

An Open API token works on the MCP server as well. Only admins can create tokens. Create MCP token on the MCP tab creates one with the scopes the tools use, except write:calendar_entries, so create_calendar_entry is not offered to it. Any token works and only the tools whose scope it carries are offered. Scopes cannot be added to an existing token: for calendar entries, create the token on the API Tokens tab and pick the scopes there.

The assistant acts as the admin who created the token, so drafts and uploads are attributed to them. A token created to act as the System user (see Authorship), or one whose creator has since been deleted, acts as the system user instead. Create MCP token always makes a token that acts as you.
Tokens are not limited by group membership. Use the sign-in flow when a manager should only see their own departments.
A token with an IP restriction is rejected when the client's IP does not match. Leave the restriction empty for AI clients.
The call_open_api tool is never offered to tokens. It is reserved for signed-in admins.

What each role can do

Role	Read	Write
Admin	Everything; the Manager Hub when the company's Manager Hub settings let admins open it	Everything, including creating groups and the raw Open API fallback
Global editor	All content, the Academy overview, content statistics and reach; the Manager Hub when the company's settings let global editors open it	Content drafts, wall post drafts, chapters, quizzes, walls, journeys, assignments
Group editor	Content targeted at the groups they edit, the Academy overview and journeys for those groups; the Manager Hub when the company's settings let group editors open it	Drafts, walls and journeys targeted at those groups, wall post drafts on walls they can post on, additions to their content, and course and journey assignments for their content
Manager	Content targeted at them, statistics and reports for the departments they manage	Announcement, event and calendar entry drafts for their departments; wall post drafts on walls they can post on; chapters, quizzes, appended content and covers on content they manage and on their own drafts; assignments of draft courses

The Tools reference lists the roles per tool.

Feature flag and limits

The MCP server is enabled per company by Monotree. When it is off, /mcp returns 403 and the discovery documents return 404.
Requests are limited to 60 per minute per signed-in person or token, the same default as the Open API. The limit can be raised per company.
Each call_open_api call also counts against the company's Open API rate limit. It runs on a token made for that one call, so the limit is counted per admin instead of per token: all of one admin's call_open_api requests share one budget.
Tools that belong to features that are off for your company are not offered: get_org_chart (org chart), manager_hub_summary (Manager Hub), create_calendar_entry (calendar), create_wall and update_wall (walls), get_ai_chat_insights (AI chat) and get_todo_compliance (to-do lists).