Connecting an AI client to the Tempa MCP server

How to add Tempa's MCP server (mcp-server.md) to Claude Code, claude.ai, Codex, Gemini CLI and GitHub Copilot (CLI and VS Code). Each client gets two setups:

• Sign-in (OAuth), the default. The client gets the URL only. On first use it finds Tempa's OAuth metadata, registers itself and opens your browser on Tempa's sign-in. You pick the organisation when you belong to several, then allow the client (auth.md). The client renews its token itself for 30 days, or less when your organisation's login policy says so.
• Pasted token, the fallback. For scripts, or a client version without MCP OAuth. Use the access token of a tempa login: jq -r .access_token ~/.tempa/credentials.json. It lasts an hour, so it suits a script that reads it fresh each time better than a long session. Keep it in an environment variable (TEMPA_TOKEN below), never in a file you commit.

The URL is https://tempa.devleaps.nl/mcp. On dev it is https://tempa.dev.devleaps.nl/mcp, a separate installation with its own sign-in. The server name tempa-admin is only a label; pick any. It is not the tempa server that the Tempa plugin's local proxy adds for company context.

Once connected, Connected apps in tempa-web (/me/connections, under Me) lists every client connected as you. You can disconnect one there, or with the disconnect_mcp_connection tool. A client in the wrong organisation moves with the switch_tenant tool.

Claude Code

Sign-in:

claude mcp add --transport http tempa-admin https://tempa.devleaps.nl/mcp

Then run /mcp in Claude Code, pick tempa-admin and choose Authenticate: the browser opens. To share it with a repo's team, use --scope project, which writes .mcp.json. Everyone signs in as themselves:

{
  "mcpServers": {
    "tempa-admin": {
      "type": "http",
      "url": "https://tempa.devleaps.nl/mcp"
    }
  }
}

Pasted token:

claude mcp add --transport http tempa-admin https://tempa.devleaps.nl/mcp --header "Authorization: Bearer ${TEMPA_TOKEN}"

claude.ai and Claude Desktop

1. Open Settings, then Connectors, then Add custom connector.
2. Name it Tempa and set the URL to https://tempa.devleaps.nl/mcp. Leave the advanced settings (client id and secret) empty: Tempa's clients register themselves.
3. Choose Connect, sign in to Tempa in the window that opens, and allow the connector. claude.ai returns to https://claude.ai/api/mcp/auth_callback.

A connector has no pasted-token setup: claude.ai needs OAuth. Each person signs in to Tempa as themselves, also when an admin added the connector for the whole claude.ai organisation.

Codex

Sign-in, in ~/.codex/config.toml:

[mcp_servers.tempa-admin]
url = "https://tempa.devleaps.nl/mcp"

Then sign in once:

codex mcp login tempa-admin

codex mcp add tempa-admin --url https://tempa.devleaps.nl/mcp writes the same table. Codex versions from before its streamable HTTP client was the default also need experimental_use_rmcp_client = true at the top of config.toml.

Pasted token, read from the environment variable it names:

[mcp_servers.tempa-admin]
url = "https://tempa.devleaps.nl/mcp"
bearer_token_env_var = "TEMPA_TOKEN"

Gemini CLI

Sign-in, in ~/.gemini/settings.json (or .gemini/settings.json in a project). Use httpUrl, which is streamable HTTP; url would mean SSE:

{
  "mcpServers": {
    "tempa-admin": {
      "httpUrl": "https://tempa.devleaps.nl/mcp"
    }
  }
}

Gemini CLI finds Tempa's OAuth from the first 401. To sign in again, run /mcp auth tempa-admin in a session. gemini mcp add --transport http tempa-admin https://tempa.devleaps.nl/mcp writes the same entry.

Pasted token (Gemini CLI expands $VAR in settings):

{
  "mcpServers": {
    "tempa-admin": {
      "httpUrl": "https://tempa.devleaps.nl/mcp",
      "headers": {
        "Authorization": "Bearer $TEMPA_TOKEN"
      }
    }
  }
}

GitHub Copilot

Copilot CLI

Add the server with /mcp add in a Copilot CLI session: type HTTP, the URL above, tools *. Or write ~/.copilot/mcp-config.json:

{
  "mcpServers": {
    "tempa-admin": {
      "type": "http",
      "url": "https://tempa.devleaps.nl/mcp",
      "tools": ["*"]
    }
  }
}

A Copilot CLI version with MCP OAuth opens the sign-in on first use. One without it gets Tempa's 401: use the token setup.

{
  "mcpServers": {
    "tempa-admin": {
      "type": "http",
      "url": "https://tempa.devleaps.nl/mcp",
      "headers": {
        "Authorization": "Bearer ${TEMPA_TOKEN}"
      },
      "tools": ["*"]
    }
  }
}

VS Code (Copilot agent mode)

Sign-in, in .vscode/mcp.json (or MCP: Add Server in the command palette). VS Code asks to allow the sign-in and opens the browser:

{
  "servers": {
    "tempa-admin": {
      "type": "http",
      "url": "https://tempa.devleaps.nl/mcp"
    }
  }
}

Pasted token: VS Code prompts for it once and stores it as a secret, so it stays out of the file:

{
  "inputs": [
    {
      "type": "promptString",
      "id": "tempa-token",
      "description": "Tempa access token (tempa login, then .access_token in ~/.tempa/credentials.json)",
      "password": true
    }
  ],
  "servers": {
    "tempa-admin": {
      "type": "http",
      "url": "https://tempa.devleaps.nl/mcp",
      "headers": {
        "Authorization": "Bearer ${input:tempa-token}"
      }
    }
  }
}

What is tested

api/tests/test_mcp_clients_doc.py reads this page. It fails when:

• a snippet is missing, or a new one has no check;
• a snippet does not match its client's documented configuration shape (the JSON Schemas in the test: Claude Code's mcpServers with type: http, Codex's [mcp_servers.<name>] with url, Gemini CLI's httpUrl, Copilot CLI's mcpServers with type: http and tools, VS Code's servers and inputs);
• a snippet points anywhere but the MCP URL, or contains a token instead of a reference to one;
• Tempa's dynamic client registration refuses a redirect URI one of these clients registers (the table below). The test then follows each one into the sign-in.

No real client runs in CI. When a client changes its configuration format, update the snippet and its schema together.

Loopback redirects may use any port (RFC 8252). Custom schemes such as cursor:// are refused (auth.md); such a client uses the token setup.