MCP

Sign-in

An assistant that connects remotely has to prove it is you. There are two ways, and both come from your vincs.io account.

A local connection (the map on this machine) has no sign-in, because there is no account. This page is about remote connections to https://mcp.vincs.io/mcp.

Two ways to sign in

A key. The account page issues two kinds: vinc_sk_ (full: read and write) and vinc_ro_ (read-only). A key goes in an Authorization: Bearer header. Use the read-only one anywhere an agent runs unattended; a full key in an agent host means a compromise of that host is a compromise of your graph. The hub enforces the scope where each tool is dispatched and fails closed: a key whose scope it cannot establish is refused the write tools.

OAuth. You paste only the address. The host and Vinc do the rest, and you approve once on a vincs.io page. This is the path claude.ai, ChatGPT, Codex and Claude Code take when they say "sign in" or "authenticate".

Which to pick is settled by who is using it. An assistant a person sits at: OAuth is easier. An agent runtime with nobody watching: a read-only key. What that runtime does with the graph, and what it must not do, is in Agents.

What happens when you press Connect

This is the part almost every host's documentation skips, and it is why nobody explains the missing client id field. The host runs the standard MCP authorization flow against Vinc, in this order.

It asks https://mcp.vincs.io/.well-known/oauth-protected-resource (and the team form of that path if you gave a team address) and learns which authorization server to talk to. That is Vinc itself; resource server and authorization server are one process.
It reads /.well-known/oauth-authorization-server and learns the three endpoints below.
It registers itself: POST /register. This is Dynamic Client Registration (RFC 7591). The host sends its name and its return address and receives a client_id minted for it. That is why claude.ai's dialog offers "register one automatically", and why ChatGPT and Codex need nothing typed: the registration is the client id. The call is unauthenticated on purpose (a host cannot have a token before it has a client), and a registration without a later approval cannot reach the graph.
It sends you to /authorize with a PKCE challenge. Vinc records the request and sends you to vincs.io to sign in and approve.
You approve. Vinc mints a one-time code stamped with your account and returns you to the host.
The host trades the code at /token for a bearer token (one hour, with refresh).

From then on every call carries that token, and Vinc stamps every read and write with your account. A team address pins the session to that team; the personal address reaches your personal graph unless a call says otherwise.

Registrations and tokens survive hub restarts. They live on the hub's persistent volume.

Things that look like errors and are not

"Needs authentication" after adding: the add stored the address; the sign-in has not happened. Open the connector and connect.
The vincs.io approval page appears in a browser, not in the host: correct. Vinc never sees your vincs.io password, and the host never sees it either.
A second host shows a second registration: also correct. Each host registers its own client. That is what dynamic registration means.

What Vinc does not do

It does not serve Anthropic's hosted client metadata document yet. On claude.ai choose the automatic registration option.
It does not stream (no SSE). Hosts that insist on the older SSE transport will not connect; every host named above uses Streamable HTTP.

Where to paste the address for each host is in Setup; what an assistant can actually call is in Tools.

Product names mentioned here are trademarks of their respective owners and are used only to indicate compatibility. Vinc is not affiliated with or endorsed by any of them.