> ## Documentation Index
> Fetch the complete documentation index at: https://woku.app/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP server

> What woku's MCP server is, how it authenticates, and what a connected agent is allowed to touch

woku exposes an **MCP server** (Model Context Protocol) so an AI agent can query your company data without a browser in the middle: wokus, NPS, CSAT, and CES metrics, form responses, action plans, and more, directly from the conversation. It is the same engine the admin panel drives: every tool runs the exact command or query the panel runs, so the two surfaces cannot grow two behaviours.

<Info>
  Authentication is **OAuth 2.1**. You connect by signing in to woku in your browser and approving a consent screen; there is no key to create or paste. That is what lets browser assistants (Claude, ChatGPT) connect, not only coding agents. `tools/list` on a live connection is always the authoritative answer about what the server offers.
</Info>

## The endpoint

```
POST https://api.woku.app/mcp
```

* **Transport:** Streamable HTTP.
* **Server name:** `woku`.
* **Stateless by design.** `GET` and `DELETE` answer `405`: there is no server-initiated stream and no session to terminate, so advertising either would be advertising a capability that does not exist.
* **No API keys.** Authentication uses OAuth and the client discovers the flow on its own; you only approve access from your woku account.

## Authentication

Access is approved from your session in the admin panel, never by sharing your password or an API key with the agent.

* **OAuth 2.1 with mandatory PKCE.** The client discovers the authorization and token endpoints on its own and completes the flow in the browser.
* **Explicit consent.** You choose the company you want to connect on the consent screen; the connection stays bound to that company.
* **Bounded lifetimes.** The authorization code lasts 10 minutes, the access token 1 hour, and the refresh token 30 days. Renewal is automatic while you use the connection.

## One connection, one company

Each connection is bound to **a single company**: the agent only sees the data of the company you approved on the consent screen. If you belong to several companies and want to query them all, create one connection per company.

## Scopes gate tools

Connections handle two permissions: `mcp:read` to query data and `mcp:write` for the tools that create or modify. If the connection does not have `mcp:write`, the write tools respond with an error indicating so and the rest keep working normally. Which tool is read or write is listed in [Tools](/docs/en/mcp/herramientas).

## Managing and revoking connections

* **Membership verified on every renewal.** When the token is renewed, it is checked that you are still a member of the company. If you are removed from the company, the connection stops working when the access token expires, within 1 hour at most.
* **Revocation from the client.** You can remove the connector in your client at any time to cut off access.

To connect a client step by step, see [Connecting a client](/docs/en/mcp/conectar-un-cliente).