Connect your assistant to CreatorRM

MCP endpoint

https://mcp.creatorrm.app/mcp

Server

https://mcp.creatorrm.app. The bare server address also accepts MCP requests, so either works.

Transport

Streamable HTTP.

Sign-in

OAuth 2.1 with PKCE (S256). Assistants register themselves (dynamic client registration), so there is no client ID or secret to set up.

Discovery

https://mcp.creatorrm.app/.well-known/oauth-protected-resource

https://mcp.creatorrm.app/.well-known/oauth-authorization-server

https://mcp.creatorrm.app/.well-known/mcp/server-card.json

1. Add the endpoint in your assistant, using the steps for it below.
2. Your assistant opens a CreatorRM sign-in window. If you are already signed in, you go straight to the permission screen.
3. Pick the workspace, review the permissions the assistant asks for, and approve. CreatorRM shows this screen for every new connection and never grants access silently.
4. The assistant gets access to that one workspace. Access renews itself while you use it. A connection left unused for 30 days has to sign in again.

To disconnect, open Settings → Integrations → Connect AI Assistants in CreatorRM and choose Disconnect under Connected apps. Owners and admins can disconnect any member's app.

• Every connection belongs to the person who signed in, and to one workspace.
• The permission screen only offers what your role allows. Admin-level permissions can only be granted by an owner or admin.
• CreatorRM checks permissions on its own servers for every tool call. Your assistant acts with your own role: an editor's assistant can do what an editor can do, and nothing more.
• The workspace owner's assistant works as soon as it connects. Today, another member's assistant needs the owner or an admin to allow it on Settings → AI → AI Delegation, which can also narrow what it may do.

A connected assistant can read content that came from outside your workspace, such as inbound email, so CreatorRM does not leave its riskiest actions to the assistant's judgment.

• Sending email, SMS, WhatsApp, Slack or Telegram messages, inviting guests to live sessions, and running automations are off for connected assistants until a workspace admin turns them on under Settings → Integrations → Connect AI Assistants → Tool permissions.
• Permanent deletes are off for connected assistants unless a workspace admin allows them.
• Where deleting is allowed, deleting a transcript takes two steps. The first returns a preview of what will be destroyed and a single-use confirmation code that expires after two minutes. Your assistant has to show you the preview and come back with the code once you confirm.

Every guide uses the same address, https://mcp.creatorrm.app/mcp. If a menu name below doesn't match what you see, look for the assistant's connectors or MCP settings; these apps rename menus often.

claude mcp add --transport http --scope user creatorrm https://mcp.creatorrm.app/mcp

gemini mcp add --transport http --scope user creatorrm https://mcp.creatorrm.app/mcp

{
  "mcpServers": {
    "creatorrm": {
      "url": "https://mcp.creatorrm.app/mcp"
    }
  }
}

{
  "mcpServers": {
    "creatorrm": {
      "url": "https://mcp.creatorrm.app/mcp"
    }
  }
}

• "No scopes requested" when you sign in. Your assistant didn't ask for any permissions. Check its connector settings for a scope field.
  Rolling outCreatorRM will offer a default set of permissions when an assistant asks for none.
• A member's assistant connects but every tool is refused. Today a member other than the owner needs an AI Delegation from the owner or an admin (see What your assistant can do).
• Sending or running an automation is refused. Those actions are off for assistants until an admin turns them on under Tool permissions.
• A self-hosted client can't finish signing in. Its callback address must use https:// or localhost.

Call the server directly with an access token:

POST https://mcp.creatorrm.app/mcp
Authorization: Bearer <access_token>
Accept: application/json, text/event-stream

• Send initialize, then tools/list. The tool list is live and authoritative; the count on the server card is approximate.
• A 401 carries WWW-Authenticate: Bearer resource_metadata="…", which points at the protected-resource metadata so a client can find the authorization server on its own.
• Access tokens last one hour. Refresh with grant_type=refresh_token; refresh tokens rotate on every use and expire after 30 days. Reusing an old refresh token revokes the whole connection.
• Honor the retry hints on 429 responses.

More for agents: the API catalog, the connect-and-produce skill, and llms.txt.