Connect an MCP client

Ngenaire runs an MCP server that exposes the co-engineer's tools — requirements, verification, risks, schedule and more — to the AI client you already use. The client authenticates with a personal access token and works as you, with exactly your permissions.

Where: user menu → API & MCP access · /settings/tokens

How it works

• Endpoint. <your Ngenaire URL>/mcp — the exact URL is shown on the API & MCP access page.
• Transport. Streamable HTTP.
• Authentication. Authorization: Bearer <token>, using a token that starts with ngn_pat_.
• Tools. The same tools the co-engineer uses, which are thin adapters over the same services the app itself calls. Every call is checked against your role on the project it touches, so the client can never see or do more than you can in the browser.

Create a token

1. Open the user menu (your avatar, top right) and choose API & MCP access.
2. Under Access tokens, click New token.
3. Give it a Name that says where it is used, so you recognise it later — for example "Claude Code on my laptop".
4. Choose Access: Read-only (search, read and analyse — recommended) or Read & write (also create and change content, within your role).
5. Choose Expires after: 7 days, 30 days, 90 days (the default) or 1 year.
6. Click Create token. The Copy your new token dialog shows the token once, with a ready-made command or config for the client selected on the page. Copy it into your password manager or client config now — Ngenaire stores only a hash and cannot show it again.

Tokens can only be created from a signed-in browser session; a token cannot mint another token.

Read-only and read & write

A read & write token held by a Viewer still cannot write: the token never adds permissions, it only carries yours.

Connect your client

Under Connect an MCP client, choose Claude Code, Claude Desktop or Cursor and copy the snippet. The page fills in your server URL, and the token too while the new-token dialog is open.

Claude Code — run in a terminal:

claude mcp add --transport http ngenaire <your-ngenaire-url>/mcp \
  --header "Authorization: Bearer <your-token>"

Claude Desktop — add to the client's MCP server configuration:

{
  "mcpServers": {
    "ngenaire": {
      "type": "http",
      "url": "<your-ngenaire-url>/mcp",
      "headers": { "Authorization": "Bearer <your-token>" }
    }
  }
}

Cursor — add to the client's MCP server configuration:

{
  "mcpServers": {
    "ngenaire": {
      "url": "<your-ngenaire-url>/mcp",
      "headers": { "Authorization": "Bearer <your-token>" }
    }
  }
}

Restart or reload the client, then ask it something simple — "list the open critical risks in my project" — to confirm the connection.

What the client can do

The client sees the same tools as the co-engineer: listing, reading, creating and updating requirements, risks, verification artifacts, schedule tasks and other project content, plus analyses such as risk statistics and the risk critical chain. Tool names are verb-first and snake_case — list_risks, get_risk, create_risk, link_risks, risk_critical_path.

Project tools need to know which project to work in. Name it in your prompt; the project id is the segment after /p/ in the app's address bar.

Your client's own model usage is billed by that client's provider, not by Ngenaire. A tool that runs one of Ngenaire's AI features charges credits to you, exactly as it would in the app.

Revoke a token

On API & MCP access, each token shows its name, access level, the first characters of the token, when it was last used and when it expires. Click Revoke and confirm; anything using the token stops working immediately. Expired tokens stop working on their own — create a new one and update the client. Creating and revoking tokens are recorded in Security activity on Security & sign-in.

Tips

• Default to Read-only. Most MCP work is search and analysis. Create a read & write token only for a client that needs to change content.
• One token per client and machine. Revoking one then breaks nothing else.
• Prefer short expiry. 30 or 90 days is plenty; renewing is a minute's work.
• Keep tokens out of source control. Put them in the client's config or a secret store, never in a repository.

Related

• What the co-engineer can do
• Roles and permissions
• Passkeys and account security
• Managing permissions
• Plans and credits