Connect an MCP client

MCP (Model Context Protocol) lets an AI assistant read your own figures directly. The assistant gets three read-only tools: list tables, describe a table, and run a SELECT query.

Nothing is written, and the assistant only ever sees the tables your account has access to.

The endpoint

https://mcp.custodea.eu/mcp

One endpoint for every customer. Your organisation is derived from your token, not from the URL, and not from anything the client sends along.

Choose a method

Custom connector (recommended)API key

For Claude.ai and other clients that support OAuth. You sign in with your normal Custodea account; there is no key to store.

1. In Claude.ai, open Settings → Connectors → Add custom connector.
2. Enter https://mcp.custodea.eu/mcp as the URL.
3. You'll be redirected to Custodea. Sign in and confirm access.
4. Done. The connector appears in your list.

To revoke access, go to Settings → Connected apps in the dashboard.

For clients without OAuth, or for scripts. Anyone can create a key for themselves; you don't need to be an administrator.

1. Go to Dashboard → Settings → MCP API keys.
2. Click Mint key and give it a recognisable label.
3. Copy the key immediately: it is shown only once.

claude_desktop_config.json

{
  "mcpServers": {
    "custodea": {
      "command": "npx",
      "args": [
        "-y", "mcp-remote",
        "https://mcp.custodea.eu/mcp",
        "--header", "Authorization: Bearer dfk_live_..."
      ]
    }
  }
}

Your key acts as you

Anyone using this key sees exactly what you can see. It carries your access, not theirs. Don't share it; a colleague can create their own in the same place.

What the assistant can do

Tool	What it does
list_tables	Every table in your lake, with row counts
describe_table	Columns, types and three sample values
query_sql	One read-only SELECT, up to 10,000 rows

Only SELECT, WITH and UNION are accepted. Every table reference must be qualified with the lake schema, for example lake.exact_online_invoices_11111.

Managing keys

Keys stay valid until you revoke them; there is no expiry date. To rotate one, create a new key, switch your client over, then revoke the old one.

The list shows your own keys. Administrators and owners see every key in the organisation, and can revoke any of them.

When someone leaves

Revoke a departing colleague's keys by hand, and remove them from every group. Deactivating the account alone is not enough.

Common errors

unauthorized on every call

The key has been revoked, or you're using a test key (dfk_test_) against production. Keys are not interchangeable between environments.

your workspace data access is still being set up

Your personal data identity is being provisioned. This normally takes a few seconds; try again.

rate limit exceeded

There is a limit per organisation and per key. The Retry-After header tells you how long to wait.