How to use MCP

Standards is a Model Context Protocol server. Point an MCP client at https://api.standards.new/v1/mcp, sign in or paste an API key, and the client gets up to 19 tools, narrowed to what your key may do. The same roles that shape the REST API shape the tool list.

Standards is also an MCP client: your workspace's own agents can call third-party servers. That direction is covered in Outbound servers. Configuring one direction has no effect on the other.

Connect a client

Two ways in. OAuth signs you in through Standards and binds the client to one workspace. An API key skips the sign-in and carries the key's roles. Cursor takes a key only.

claude mcp add --transport http standards https://api.standards.new/v1/mcp

standards keys create --name "claude-code" --yes

claude mcp add --transport http standards \
  https://api.standards.new/v1/mcp \
  --header "Authorization: Bearer stndrds_your_api_key"

codex mcp add standards --url https://api.standards.new/v1/mcp
codex mcp login standards

export STANDARDS_API_KEY="stndrds_your_api_key"

# ~/.codex/config.toml
[mcp_servers.standards]
url = "https://api.standards.new/v1/mcp"
bearer_token_env_var = "STANDARDS_API_KEY"

{
  "mcpServers": {
    "standards": {
      "url": "https://api.standards.new/v1/mcp",
      "headers": { "Authorization": "Bearer stndrds_your_api_key" }
    }
  }
}

The OAuth path is described in OAuth: scopes, consent, token lifetimes and the rules a client must meet. The key path is described in Workspaces and API keys.

What the client receives

The server has no system prompt of its own, so it introduces the workspace in the instructions field of the handshake. The text lists every object the key can read, one line per object with its name, label and description, then four fixed usage rules:

You are connected to a Standards workspace through its MCP tool surface.

Readable objects:
- contacts (Contact): People you work with.
- invoices (Invoice)

Usage rules:
- Object names are kebab-case and usually plural (e.g. "contacts", "invoices").
- Call get_schema for an object's attributes before writing to it.
- Deletes are reversible but must be confirmed with the user before you call a delete tool.
- Prefer get_record over search_records when the record id is already known.

A key that reads nothing gets (no objects are readable with this key) in place of the index. Attribute detail is not in the payload; the client calls get_schema for it. The full tool list and the two refusal shapes are on Tools.

The endpoint

Authentication

Send one of two credentials in the Authorization header:

• an API key: Authorization: Bearer stndrds_…;
• an OAuth access token issued to this workspace, see OAuth.

Browser login sessions and ID tokens are not MCP credentials. What goes wrong:

Next steps

• OAuth — scopes, consent, token lifetimes and client admission rules.
• Tools — the tools a client can see, their limits, and how a refusal looks.
• Outbound servers — let your agents call third-party MCP servers.
• Agent workflow — a full session from get_schema to update_record.