MCP server

Nömad runs a single MCP server for all your brands at https://app.nomad.ooo/api/mcp. When connecting you choose which brands and scopes to grant; the tools are the same capabilities Nödo uses.

Status. Today a pilot server per brand runs with four read tools and clients authorized one by one. The single multi-brand server described here turns on in the «Registry and MCP» phase.

Connect

• Claude: Settings › Connectors › Add custom connector, paste the URL and authorize.
• ChatGPT: Settings › Apps and connectors › Create, paste the URL and authorize.
• Cursor, VS Code and other clients: add a remote HTTP server with the URL; the client opens the Nömad consent screen.

{
  "mcpServers": {
    "nomad": { "url": "https://app.nomad.ooo/api/mcp" }
  }
}

Authorization

• OAuth 2.1 with PKCE on Supabase Auth (OAuth 2.1 + PKCE). The server publishes protected resource metadata (RFC 9728) and answers 401 with WWW-Authenticate so clients discover where to authorize.
• The token always travels in the Authorization header and is audience-bound to this server (RFC 8707); tokens for another audience are rejected and never passed through.
• If a tool needs a scope you did not grant, the answer is 403 insufficient_scope listing every required scope at once.
• The consent screen lets you pick brands and scopes; revoke it in Settings › MCP.

Protocol

• Revision 2026-07-28, stateless: every request stands alone and the server implements server/discover.
• Tool names use underscores (works_list), valid in every client and in voice.
• Every tool declares inputSchema and outputSchema; output goes in structuredContent and as JSON text for older clients.
• Annotations: readOnlyHint on reads, destructiveHint on what deletes or disconnects, idempotentHint, and openWorldHint when leaving Nömad. They are client hints, not security: the permission gate is.
• Business errors return isError: true with a message the model can act on; protocol errors are JSON-RPC errors.
• Lists are paginated with an opaque cursor in deterministic order.
• Writes that need confirmation return input_required with a summary; the client asks the person and retries with the answer.
• Long tasks (images) return a task the client follows with tasks/get.

Resources and prompts

• nomad://brand/{brand}/genome, /kit and /soul: the brand as context another agent can read.
• Prompts brand-brief, brand-voice and weekly-review to start a conversation well.