Skip to main content

MCP Server

Connect Claude or Cursor to Bryn and ask questions in plain language: "which accounts hit pricing this week?", "what did Bryn run yesterday?", with no API code required. Whatever the Control Plane API exposes, an MCP client can use as tools.

Bryn exposes a Model Context Protocol server for this. It speaks streamable HTTP and is secured with Civic Auth over OAuth.

Endpoint​

https://bryn.civic.com/mcp

Authentication​

The server is secured with Civic Auth over OAuth. Clients that support OAuth will open the Bryn login page in your browser the first time you connect: sign in there, and the client is authorized automatically. There's no token or API key to copy.

Your tenant is resolved from your Civic Auth membership, the same way the REST API resolves it:

  • One membership → that tenant is selected automatically; nothing to configure.
  • More than one → pin the tenant in the connector URL with the tenant query parameter: https://bryn.civic.com/mcp?tenant=<tenantId>. Most MCP clients can't set custom headers, so the query parameter is the practical selector — but the X-Bryn-Tenant: <tenantId> header works too where a client can set one.
  • Multi-membership with neither selector → 403 ambiguous_tenant.
  • A tenant you don't belong to → 403 tenant_forbidden.
note

The tenant query parameter and the X-Bryn-Tenant header are selectors, not the source of truth: the tenant bound at the data layer is always taken from the matched membership. Naming different tenants in the two is rejected.

Connecting​

Clients that don't yet support remote MCP servers with OAuth can bridge through mcp-remote, which handles the OAuth flow locally.

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "bryn": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://bryn.civic.com/mcp"]
    }
  }
}

Restart Claude Desktop, then complete the Civic Auth sign-in when prompted.

note

Once connected, your client lists the tools Bryn provides; this page intentionally doesn't catalogue them. Discover the current set directly in your MCP client.