MCP

Every project speaks MCP so AI tools can use it as a tool server. The fastest way to connect is one command:

npx thinkingroot connect

It signs in, picks your tools, and wires each one — plus installs the memory skill (auto-recall) and slash commands (/recall, /remember, /context, /forget). For per-client copy-paste config, see Connect your AI tool; this page explains what's happening underneath.

What your AI gets

Once connected, the client sees ThinkingRoot's tools — ask, search, compile, branch operations — plus the tools of any connectors you've installed. Installing a connector live notifies connected clients via a tools/listChanged notification, so new tools show up without a reconnect.

Transport

Use Streamable HTTP: https://api.thinkingroot.com/mcp. This is the URL to paste into ChatGPT, Claude, Cursor, or any modern MCP client — initialize mints an Mcp-Session-Id header, responses return on the POST body, and DELETE /mcp ends the session (MCP spec 2025-03-26).

A legacy 2024-11-05 dual-channel SSE transport also exists for older clients:

• GET /mcp/sse opens a long-lived Server-Sent Events stream (server → client) and first emits an endpoint frame telling the client where to POST.
• POST /mcp (with a ?sessionId=) carries client → server JSON-RPC requests, correlated back onto the SSE stream.

Do not hand /mcp/sse to ChatGPT or a connector directory — they reject legacy SSE outright. When in doubt, use /mcp.

The gateway in the middle

The engine's own MCP endpoint has no authentication — it's loopback-only and assumes a trusted caller. The gateway is that caller:

1. It authenticates your inbound Authorization: Bearer tr_sk_… key and resolves which project's engine to talk to.
2. It injects the engine's internal key and relays the stream.
3. It rewrites the endpoint frame so the client posts back to the gateway (not the daemon directly), then relays those POSTs verbatim.

So your tr_sk_… key never reaches the engine, and the engine is never exposed to the internet.

Authentication

All MCP traffic authenticates with a project tr_sk_… key as a bearer token. Create one in the API Keys tab; revoke it there to cut off access instantly.