Connect
Signing in
The remote address (https://mcp.vincs.io/mcp) always asks you to sign in. There are two ways: OAuth, which the host handles for you, and a key you paste yourself.
Signing in with OAuth
You only enter the address. claude.ai, ChatGPT, Claude Code and Codex CLI use this when you press "Connect" or "Sign in".
- The host registers itself with Vinc, which is why there is no client ID or secret to enter.
- vincs.io opens in your browser. Sign in and approve the connection. Your password goes only into the Vinc account page and never reaches the host.
- After you approve, you go back to the host, which receives a token that lasts an hour. The host refreshes it, so you rarely sign in again.
A host connected with OAuth can read and write your graph. On a team address it can do only what your role in the team allows (table below).
Signing in with a key
Use this when the host cannot finish OAuth, or when an agent runs where nobody is watching. Make a key on your vincs.io account page and put it in the host's Authorization: Bearer <key> header. The key is shown only once, when you make it, so copy it right away.
- Full-access key (starts with
vinc_sk_): reads and writes. - Read-only key (starts with
vinc_ro_): only reads. Tools that write or delete are refused.
Give an agent nobody is watching a read-only key. If a host holding a full-access key is compromised, so is your graph.
What you can do in a team
On a team address, your role in the team decides which tools you can use.
| Role | What it can do |
|---|---|
| View | Search and read. |
| Edit | Write and change nodes and documents. |
| Admin | Delete nodes, links and documents, and merge nodes. |
Connecting to the address of a team you are not in answers exactly as if the team did not exist, so nobody outside can find out which teams there are.
When it does not connect
- "Needs authentication" right after adding: only the address was saved; the sign-in has not happened yet. Press Connect on the connector.
- The approval page opens in a browser, not in the host: that is expected. You sign in on vincs.io.
- Each host shows its own connection: that is expected. Each host registers itself separately.
- A host that connects only over SSE, such as OpenClaw by default: Vinc connects only over Streamable HTTP. Set the host's transport to
streamable-http. - Write tools refused as "read-only": you connected with a read-only key. Make a full-access key to let it write.