Connecting Cursor and Claude Code to Mandatum
This guide adds Mandatum as a remote MCP server in Cursor and Claude Code. There are two ways to authenticate:
- OAuth (recommended for people): you sign in to Mandatum in your browser. The client receives a token scoped to your account.
- API key (recommended for automation): you send an
mdt_key as a Bearer token. Use this for scripts, CI and shared service accounts.
Replace mandatum.intergentech.ai with your deployment's host if it differs.
MCP endpoint: https://mandatum.intergentech.ai/api/mcp
Option A: OAuth #
OAuth works through a loopback redirect. When you authorize, the client starts a short-lived listener on your own machine (127.0.0.1 or localhost, on a port it picks), and your browser returns the authorization code there. This follows RFC 8252. The port changes between sessions, and Mandatum accepts any port on a loopback address for the same path.
You need to be signed in to Mandatum in the same browser before you start.
Cursor #
- Open Cursor's MCP settings and add a new server, or edit
~/.cursor/mcp.jsondirectly:json{ "mcpServers": { "mandatum": { "url": "https://mandatum.intergentech.ai/api/mcp" } } } - Save. Cursor starts the sign-in flow the first time it connects. Approve the consent screen in your browser.
- Confirm the Mandatum tools appear as enabled in Cursor's MCP panel.
Claude Code #
- Add the server from a terminal:
bash
claude mcp add --transport http mandatum https://mandatum.intergentech.ai/api/mcp - Start Claude Code, run
/mcp, selectmandatum, and choose Authenticate. Approve the consent screen in your browser. - Check the connection with
/mcpagain. It should report the server as connected.
Option B: API key #
Create a key on the workspace's API keys page (/w/<workspace>/settings/integrations). Owners and admins can create keys. Keys look like mdt_live_<random> (production) or mdt_test_<random> (test). The key's tool access is set under Sharing Controls and can be changed later. The raw key is shown once, so store it somewhere safe.
Cursor #
{
"mcpServers": {
"mandatum": {
"url": "https://mandatum.intergentech.ai/api/mcp",
"headers": {
"Authorization": "Bearer mdt_live_your_key_here"
}
}
}
}Claude Code #
claude mcp add --transport http mandatum https://mandatum.intergentech.ai/api/mcp \
--header "Authorization: Bearer mdt_live_your_key_here"Revoking access #
- OAuth connections: on the API keys page, find the client under Connected apps and click Revoke. Its access and refresh tokens stop working immediately.
- API keys: revoke the key in the API keys list on the same page. Rotate it if you need a new secret.
Troubleshooting #
"redirect_uri ... is not in the allowed redirect URI list" means the client is redirecting somewhere other than a loopback address, or to an https callback the server does not allow. Loopback is always allowed. Other callbacks must appear in the server's OAUTH_REDIRECT_ALLOWLIST. Ask your Mandatum administrator to add it to OAUTH_REDIRECT_ALLOWLIST.
Sign-in opens but returns to an error page: make sure you are signed in to Mandatum in the same browser and that the workspace you want is your default. Then retry the connection from the client.
Tools are missing: the key or the OAuth grant only includes the scopes it was issued with. Check the key's tool settings, or reconnect the OAuth client and approve the scopes you need.