MCP server

Nömad runs a single MCP server for all your brands at https://app.nomad.ooo/api/mcp. When connecting you choose which brands and scopes to grant; the tools are the same capabilities Nödo uses.

Status. Available for clients authorized one by one. A single server at /api/mcp, one connection for every brand you open in the consent; its tools come from the registry and take brand. The old per-brand path keeps working.

Progressive catalogue. The tool list carries the main capabilities; everything else you can do in Nömad (every action of every screen) is found with nomad_find (search by what you want to do), read with nomad_describe (input, output, permission and whether it waits for approval) and run with nomad_call, behind the same permission gate and agent policy. The list never grows with the app and the agent always sees the current contract.

Connect

• Claude: Settings › Connectors › Add custom connector, paste the URL and authorize.
• ChatGPT: Settings › Apps and connectors › Create, paste the URL and authorize.
• Cursor, VS Code and other clients: add a remote HTTP server with the URL; the client opens the Nömad consent screen.

Clients admitted from day one: Claude (claude.ai, Claude Desktop, Claude Code), ChatGPT (chatgpt.com, ChatGPT desktop), Cursor (Cursor editor), Visual Studio Code (GitHub Copilot agent mode). Other clients are added after review.

{
  "mcpServers": {
    "nomad": { "url": "https://app.nomad.ooo/api/mcp" }
  }
}

Authorization

• OAuth 2.1 with PKCE on Supabase Auth (OAuth 2.1 + PKCE). The server publishes protected resource metadata (RFC 9728) and answers 401 with WWW-Authenticate so clients discover where to authorize.
• The token always travels in the Authorization header and is audience-bound to this server (RFC 8707); tokens for another audience are rejected and never passed through.
• If a tool needs a scope you did not grant, the answer is 403 insufficient_scope listing every required scope at once.
• The consent screen lets you pick brands and scopes; revoke it in Settings › MCP.
• Reading is always allowed, within the consent. What an agent changes is decided by the brand's agent policy (Settings › Nödo › Outside agents, or the workspace › Developers): Read only, With approval (the default: each change waits in your account › Approvals and we let you know) or Direct. Drafts, ideas and review requests never wait: they already leave the decision to a person.
• Critical actions are never an agent's, whatever the policy says: deleting for good, publishing, mass sending, charges and critical roles answer agent_write_blocked.

Protocol

• Revision 2026-07-28, stateless: every request stands alone and the server implements server/discover.
• Tool names use underscores (works_list), valid in every client and in voice.
• Every tool declares inputSchema; output goes in structuredContent and as JSON text for older clients. Each tool's output schema is in this reference and does not travel in tools/list, so the model does not pay for it on every turn; the server validates every answer against it.
• Limits: 240 requests per minute per connection (person and client) and 20 failed tokens per minute per address; past them, 429 with Retry-After. A result above 25,000 tokens is refused with result_too_large: ask for fewer items, the concise format or the next page with cursor.
• Annotations: readOnlyHint on reads, destructiveHint on what deletes or disconnects, idempotentHint, and openWorldHint when leaving Nömad. They are client hints, not security: the permission gate is.
• Business errors return isError: true with a message the model can act on; protocol errors are JSON-RPC errors.
• Lists are paginated with an opaque cursor in deterministic order.
• A write waiting for approval is not an error: the tool answers structuredContent.status = "approval_required" with the link where the person decides. The agent says so and does not resend it; it runs once when approved.
• Long tasks (images) return a task the client follows with tasks/get.

Resources and prompts

• Resource nomad://brand/{brand}/genome: the Genome summary another agent can read, on single-brand connections granted genome.read.
• Prompt brand-brief to prepare a brief from the brand context you are allowed to see.