Connecting a client #
Classification: Internal-Only
How to point an MCP client at tofu-external-mcp in each environment. Every connection is a real Clerk login: the client discovers the OAuth endpoints, the user signs in, and the client keeps a token. No API key or token is copied by hand.
| Environment | URL | Reachable from | Client | Status |
|---|---|---|---|---|
Local (dev_local) |
http://localhost:3003 |
Your machine (or your Coder workspace) | Claude Code CLI | Supported — see Local development |
| Deployed dev | https://dev-mcp.internal.gotofu.com |
Internal hostname, not public | — | Not a supported connection path; ask the MCP owners before relying on it |
| Prod | https://mcp.gotofu.com |
Public, behind Cloudflare Access (Anthropic egress IPs allowlisted) | claude.ai connector | Intended path; not re-tested in the dev_local work |
| Deployed dev / prod | — | — | Claude Code CLI | Not supported today (see below) |
claude.ai (web / desktop) — prod #
In Claude’s settings go to Connectors → Add custom connector and enter the prod URL (https://mcp.gotofu.com). Claude walks the user through the Clerk sign-in, and the tools become available in any chat.
How it works under the hood: claude.ai ignores the RFC 8414 / 9728 metadata and builds /authorize, /token and /register from the base URL, so this server proxies those to Clerk (src/routes/oauth-proxy.ts). Only prod is public: it sits behind a Cloudflare Access policy that allowlists Anthropic’s egress IPs (configured outside this repo), so it is reached through the connector, not directly. Deployed dev is an internal, non-public hostname and is not a supported claude.ai connection path.
Claude Code CLI #
- Local (
dev_local): supported. Follow Local development. - Deployed dev and prod: not supported today (ENG-8442). The CLI always redirects its OAuth login to a loopback address (
http://localhost:<port>/callback),/authorizeanswers 400 for loopback redirects outsidedev_local, and a confidential Clerk app would also need the client secret on every user’s machine. Use the claude.ai connector for prod.
What the user sees #
The first tool call (or /mcp → Authenticate in Claude Code) opens a browser for the Clerk sign-in. The consent screen asks which organization to use; the token is scoped to that organization, so tools only see that organization’s data. After that the session stays signed in.