API basics

Connecting Claude via MCP

The ERI Model Context Protocol (MCP) connector lets a Claude assistant read ERI reports your organization can access, with each user authenticating to ERI with their own account.

Protocol

MCP (Streamable HTTP)

Auth

OAuth 2.1 + PKCE

Scope

reports:read

Registration

CIMD

What this connector is

A client-user token lets a Claude workspace read ERI reports that the user's organization is already entitled to on the ERI platform. The connector is read-only — it cannot create, update or delete anything. Access is per person: each user signs into ERI with their own account the first time they use it, and the connector enforces that organization's access on every tool call.

Separate from the API Key

This connector is not the ERI Core API. API Keys authenticate server-to-server calls; the MCP connector authenticates an individual user's AI assistant. Keys and MCP grants are managed independently.

Connector URL

Users paste a per-environment URL into Claude. The current URLs are:

Environment	Connector URL
Stage	https://mcp.staging.emergentriskinternational.com/mcp
Production	provided to each organization after Admin enables MCP access

A production URL is only issued once your ERI account manager has enabled MCP access for your organization.

How a user connects

1. In Claude, the user opens Settings → Connectors → Add custom connector and pastes the connector URL.
2. Claude discovers ERI's OAuth 2.1 authorization server (RFC 8414) and protected-resource (RFC 9728) metadata, then redirects the user to https://mcp.<domain>/oauth/authorize.
3. ERI redirects to the client portal consent page (/connect?request=<id>). If the user is not signed in, the portal asks for email, password and the six-digit TOTP code first.
4. The consent card shows the assistant name, the host Claude is redirecting from, and the read-only scope. The user clicks Allow or Deny.
5. On Allow, Claude receives an authorization code (PKCE S256), exchanges it for an opaque access token (15 min) and a rotating refresh token (14 days idle, 30 days absolute). Reuse of a consumed refresh token revokes the whole grant.

Authentication details

• PKCE S256 only — the authorization server rejects plain challenges and requests without a challenge.
• RFC 8707 resource parameter on every token request; token audience is pinned to the connector URL (<issuer>/mcp).
• iss on every authorize response and error (RFC 9207) so Claude can validate it against the discovered authorization server.
• CIMD (Client ID Metadata Document) registration: when Claude presents an https client-id URL that resolves to a document on claude.ai or claude.com, ERI accepts it. Other hosts are refused. There is no Dynamic Client Registration.
• Opaque tokens: ERI stores only a SHA-256 hash of each token. There are no JWTs.

What the assistant can see

• The connector offers three tools: search_reports, get_report, and list_filter_values.
• Results obey the same access rules as the client portal — reports are filtered by the user's organization entitlement.
• Report images are stripped from tool output: the assistant is given a placeholder and the report link on the platform (no pre-signed media URLs leak).
• Report bodies are capped around 60k characters; the response flags body_truncated when a report is clipped.

Rate limits

Separate from the Core API counters:

• Per user: 60 calls per minute, 1,000 per UTC day.
• Per organization: 5,000 per UTC day.

Over-limit responses still return HTTP 200 with an isError tool result and the reset time. list_filter_values, tools/list, and discovery requests are not counted.

Egress

MCP traffic terminates on dedicated hosts behind CloudFront and WAF. Egress for stage goes through the shared ERI NAT range; the production range is shared with your account manager during onboarding so you can allow-list it if required.

Data handling

• ERI never sees the user's prompts; the connector only ever receives tool-call parameters.
• Each tool call is logged with the user and organization id, the tool name, the result (success / rate_limited / tool_error / unauthorized), the ids of any reports returned, and HMAC hashes of free-text search strings. Full queries and report bodies are never logged.
• Grants and refresh tokens can be revoked per user by the ERI account manager, or by the user removing the connector in Claude.

Disabling MCP for an organization

An ERI Admin can toggle MCP access per organization in the admin panel. Toggling it off causes the next tool call to answer isError with the "contact your account manager" copy; existing grants are not revoked, so turning the switch back on resumes the assistant.