Other clients

Lahuta works with any MCP client that can add a remote server by URL and sign in through the browser. If your client doesn't have its own page here, look in its settings for an option to add a remote, HTTP or "streamable HTTP" MCP server.

https://api.lahuta.org/mcp

What your client needsCopy Anchor Link

• It supports the streamable HTTP transport. Lahuta speaks the current MCP transport over plain HTTP POST. The older "HTTP with SSE" transport isn't supported, so a client that only asks for an SSE URL can't connect.
• It handles MCP's browser sign-in, also called OAuth. Clients that only accept a fixed token or header won't work.
• It runs as an app, a command-line tool or on a server. Lahuta turns away requests that come from code running inside a web page. Desktop apps, terminal tools and hosted assistants like Claude, ChatGPT and Gemini aren't affected.

Config examplesCopy Anchor Link

Many clients read a JSON file with an mcpServers list. For those, the entry looks like this:

{
  "mcpServers": {
    "lahuta": {
      "url": "https://api.lahuta.org/mcp"
    }
  }
}

Key names differ between clients, so check your client's docs for the exact shape.

VS CodeCopy Anchor Link

In VS Code, run MCP: Add Server from the Command Palette and follow the prompts, or edit the file yourself. Use .vscode/mcp.json for one workspace, or MCP: Open User Configuration for all of them:

{
  "servers": {
    "lahuta": {
      "type": "http",
      "url": "https://api.lahuta.org/mcp"
    }
  }
}

VS Code opens your browser to sign in the first time it starts the server. See VS Code's MCP servers guide for the rest.

For developersCopy Anchor Link

If you're building your own client or debugging a connection, these are the details.

TransportCopy Anchor Link

Sessions are kept in memory on one server. If a request comes back 404 for an unknown session, start a new one with initialize, as the MCP spec asks clients to do. Most clients do this on their own.

Sign-inCopy Anchor Link

A request without a valid token gets 401 and points to the sign-in details:

HTTP/2 401
www-authenticate: Bearer resource_metadata="https://api.lahuta.org/.well-known/oauth-protected-resource"

The protected resource metadata names the authorization server:

curl https://api.lahuta.org/.well-known/oauth-protected-resource

{
  "resource": "https://api.lahuta.org/mcp",
  "authorization_servers": ["https://auth.lahuta.org"],
  "bearer_methods_supported": ["header"]
}

The authorization server at https://auth.lahuta.org publishes its metadata at /.well-known/oauth-authorization-server. It supports the authorization code flow with PKCE (S256), refresh tokens, client ID metadata documents and dynamic client registration, so your client can register itself. Use https://api.lahuta.org/mcp as the resource, and send the access token as Authorization: Bearer <token>.

The token identifies a person. Lahuta works out their organization and role on each tool call, from the organization chosen at sign-in or from the call's org argument.

Tools and resultsCopy Anchor Link

• Every tool accepts an optional org argument, a slug or id, on top of its own arguments. See Organizations and permissions.
• Every tool carries readOnlyHint and destructiveHint annotations. When a tool returns an object, it has an outputSchema, and the result comes back as structuredContent plus the same JSON as text.
• When Lahuta refuses a call, the result has isError: true and a JSON body with a reason, like Forbidden or NotFound, and a message, like permission: events:manage.
• Arguments that don't match the tool's schema get a JSON-RPC invalid params error.
• An unexpected failure returns isError: true with the text "Tool execution failed due to an internal server error."

GET https://api.lahuta.org/mcp/catalog returns the number of tools per area, with no sign-in. The full list is in the Tools reference.

RelatedCopy Anchor Link