MCP Connectors API¶

Preview

MCP connectors are in preview. They are available on environments where the MCP server has been enabled; ask your Quadified contact. Where it is not enabled, these endpoints return 404.

An MCP connector gives an LLM agent (for example Claude Code or Codex CLI) a token for the platform's MCP server at https://app-<environment>.quadified.com/mcp. The agent then authors and runs tests as the user who created the connector, with that user's permissions and nothing administrative. MCP Connectors describes the same tasks in the Web UI.

Treat the token like a password

The token is returned once, when the connector is created or rotated. Store it only in the MCP client's configuration, never in a repository. If it may have leaked, rotate or revoke the connector at once.

Create a connector¶

Role: Standard and above.

label (1-255 characters) says what the connector is for. expiryDays is 1-365 and defaults to 90; a connector cannot be created without an expiry date.

Request body *

{
"label": "string",
"expiryDays": 90
}

Responses

Code	Description
201	The connector was created. `token` is returned only in this response; store it now. Only its hash is kept, so it cannot be shown again. Media type: application/json Example Value: { "token": "atfmcp_...", "connector": { "id": "7f0c3a52-1d6e-4b8a-9f00-2c5d8e4a1b90", "label": "string", "ownerEmail": "user@example.com", "tokenPrefix": "Xy7Q2k", "createdAt": "2026-09-23T10:00:00Z", "expiresAt": "2026-12-22T10:00:00Z", "revokedAt": null, "lastUsedAt": "2026-09-23T10:05:00Z", "status": "ACTIVE" } }
400	`label` is missing or longer than 255 characters, or `expiryDays` is outside 1-365.
403	The call was made with a connector token. Connectors cannot manage connectors.
409	You already hold the maximum number of active connectors (2 by default). Rotate one you use, or revoke or delete one you no longer need.
404	The MCP server is not enabled for this environment.

List connectors¶

Role: Standard and above.

An operator sees and manages the connectors they created; an Admin sees and manages every connector of the tenant.

Responses

Code Description

200

The connectors you can see, newest first (not paged). status is ACTIVE, EXPIRED or REVOKED. tokenPrefix is the first characters after atfmcp_, to tell connectors apart. lastUsedAt is accurate to a few minutes.

Media type: application/json

Example Value:

[
    {
        "id": "7f0c3a52-1d6e-4b8a-9f00-2c5d8e4a1b90",
        "label": "string",
        "ownerEmail": "user@example.com",
        "tokenPrefix": "Xy7Q2k",
        "createdAt": "2026-09-23T10:00:00Z",
        "expiresAt": "2026-12-22T10:00:00Z",
        "revokedAt": null,
        "lastUsedAt": "2026-09-23T10:05:00Z",
        "status": "ACTIVE"
    }
]

403

The call was made with a connector token. Connectors cannot manage connectors.

404

The MCP server is not enabled for this environment.

Revoke or delete a connector¶

Role: Standard and above.

An operator sees and manages the connectors they created; an Admin sees and manages every connector of the tenant.

Parameters

Name	Description
id *	ID of the connector. Type: string (path)
purge	`true` deletes the connector and its record. Leave it out to revoke: the token stops working and the connector stays in the list as `REVOKED`. Type: boolean (query)

Responses

Code	Description
204	The connector was revoked (or deleted with `purge=true`). Its token stops working at once.
403	The call was made with a connector token. Connectors cannot manage connectors.
404	No such connector, one you cannot see, or the MCP server is not enabled for this environment.
409	The connector is already revoked. Not returned with `purge=true`.

Rotate a connector's token¶

Role: Standard and above.

expiryDays (1-365, default 90) counts from now. Rotating does not count towards the connector limit, so it also works when you already hold the maximum.

Parameters

Name	Description
id *	ID of the connector. Type: string (path)

Request body

{
"expiryDays": 90
}

Responses

Code	Description
200	A new token was issued. The old one stopped working at the same moment. The connector keeps its ID, label, owner and history. `token` is returned only in this response. Media type: application/json Example Value: { "token": "atfmcp_...", "connector": { "id": "7f0c3a52-1d6e-4b8a-9f00-2c5d8e4a1b90", "label": "string", "ownerEmail": "user@example.com", "tokenPrefix": "Xy7Q2k", "createdAt": "2026-09-23T10:00:00Z", "expiresAt": "2026-12-22T10:00:00Z", "revokedAt": null, "lastUsedAt": "2026-09-23T10:05:00Z", "status": "ACTIVE" } }
400	`expiryDays` is outside 1-365.
403	The call was made with a connector token. Connectors cannot manage connectors.
404	No such connector, one you cannot see, or the MCP server is not enabled for this environment.
409	The connector is revoked. A revoked connector cannot get a new token; create a new connector instead.