MCP server
Cursare ships an MCP server (Model Context Protocol) so AI clients — Codex, ChatGPT, Claude, Cursor, and any MCP-compatible agent — can operate your organization in natural language: browse and edit contents, enroll learners, issue refunds, summarize insights. This page covers connecting a client, how authentication and permissions work, what the tools cover, and how to author course content with an AI assistant.
What it is
The server lives at https://mcp.cursare.com and exposes one tool per operational API contract, generated from the same zod contracts that drive the REST API and its OpenAPI document. Each tool is the snake_case form of the API operation — list_contents, enroll_learner, refund_purchase — with the exact same request and response schemas. The REST API's self-describing index and public OpenAPI document are deliberately not tools; every organization operation is. A connected assistant invokes them from plain language: the client picks the tool, fills the arguments, and shows you the result.
Because the tools and the REST API share one contract source, they never drift: a field added to the API appears in the matching tool on the same deploy.
Connect
The recommended path is Settings → Developer → MCP → Add assistant. Choose the client first; Cursare uses browser OAuth where supported and creates a dedicated one-year organization API key for headless clients. The key is shown once. Advanced manual setup keeps the endpoint and raw snippets available without making them the starting point.
During OAuth, the consent screen requires an explicit organization. A valid active dashboard organization is preselected; an ambiguous external start requires a choice. The grant stores that organization permanently, so switching dashboard organizations never retargets an existing assistant.
Codex and ChatGPT
Add Cursare to Codex CLI, then sign in through the browser:
codex mcp add cursare --url https://mcp.cursare.com
codex mcp login cursare
The same MCP configuration is available to the Codex IDE extension and ChatGPT desktop when they run on the same Codex host. In ChatGPT desktop, you can also open Settings → MCP servers and add https://mcp.cursare.com directly. ChatGPT on the web receives remote MCP tools through an installed app or plugin rather than the local Codex configuration.
claude.ai and Claude Desktop
- Open Settings → Connectors → Add custom connector.
- Paste
https://mcp.cursare.comand confirm. - A browser window opens — sign in with Cursare (your existing session is reused if you have one).
- Review the consent screen and click Allow.
The connector is now available in your chats, acting as you, with your roles.
Claude Code
With OAuth (a browser login, same consent flow as above):
claude mcp add --transport http cursare https://mcp.cursare.com
Or headless, with a dedicated key from Settings → Developer → MCP → Add assistant:
claude mcp add --transport http cursare https://mcp.cursare.com --header "Authorization: Bearer cr_live_..."
Cursor and other MCP clients
Any client that speaks MCP over Streamable HTTP works the same way: point it at https://mcp.cursare.com. If the client supports OAuth, an unauthenticated request triggers the browser sign-in automatically; otherwise, configure a bearer header with a cr_live_ API key. In Cursor, for example, add the server URL to your MCP configuration and optionally set the Authorization header.
A quick sanity check
Whichever client you connected, ask it something read-only first — list my courses or how many learners enrolled this week? — and confirm the answer matches your dashboard. A working read means the credential, the organization, and the tool wiring are all correct before you let the assistant write anything.
Authentication and permissions
The server accepts two kinds of credentials, and which one you use decides what the assistant is allowed to do:
| OAuth user token | Organization API key | |
|---|---|---|
| Identity | The signed-in user plus the explicitly selected organization | The organization itself |
| Permissions | The user's real team roles apply — editor, finance, cohort, learners | Org-admin authority over the whole organization |
| How you get it | Browser sign-in + consent screen, handled by the client | Created at Settings → Developer → MCP (cr_live_…) |
| Revocation | Revoke the exact assistant/member/organization connection under Developer → MCP | Revoke or replace the dedicated key on the same MCP page |
| Best for | Personal assistants — Codex, ChatGPT desktop, Claude, Cursor | Headless agents, CI, shared automation |
A finance-role member connected via OAuth can read sales but cannot rewrite a course; an API key can do both. Pick the narrower credential when the narrower one is enough.
What the tools cover
The callable API contracts are grouped by resource:
| Group | Example tools |
|---|---|
| Organization | Profile/members, custom domain, organization shape, audit events, API-key list/revoke, MCP connections, resolve_reference |
| Contents | list_contents, create_content, get_content, update_content, delete_content, publish_content, duplicate_content |
| Offers | list_offers, list_content_offers, create_offer, get_offer, update_offer, duplicate_offer, set_primary_offer, archive_offer |
| Authoring | get_document_schema, get_content_document, replace_content_document — the document format reference plus full draft read and replace |
| Learners | List/enroll/update/unenroll, single and bulk progress reset, mastery, enrollment-request list/summary/approve/reject |
| Cohorts | list_content_cohorts, create_cohort, update/delete, assign/move/remove learner, set_cohort_member_role |
| Cohort discussion | list_cohort_discussion, create_cohort_discussion_post, resolve_discussion_post, pin_discussion_post, delete_discussion_post |
| Intake forms | list/create/get/update/delete |
| Campaigns | list_campaigns, create/update/delete |
| Teams | list/create/get/update/delete, add/remove member, set_team_member_roles |
| Sales & payouts | list_sales, purchase list/get/by-content, refund_purchase, get_payouts |
| Affiliates | Program get/update, affiliate list/approve/block, commission override and settlement |
| Insights | get_insights, get_insights_series, get_content_insights, get_content_sales, list_content_reviews |
| Integrations | Four-capability status plus Google, WhatsApp, video uploads, and payment operations |
| Webhooks | list/create/update/delete, list_webhook_deliveries, test_webhook |
The same deliberate gaps as the REST API apply: no personal authentication, no acting as a learner, no API-key minting.
Complete tool reference
This inventory is rendered from the live contract registry, so it includes every currently callable tool and updates automatically with the code.
161 tools, generated from the live API contracts
Organization
get_organizationget_minor_organization_settingsupdate_minor_organization_settingsget_seller_profileupdate_seller_profileupdate_organizationlist_membersget_organization_shaperesolve_referenceget_custom_domainset_custom_domainverify_custom_domaindelete_custom_domainlist_audit_eventslist_api_keysrevoke_api_keySales and payouts
list_salesrefund_purchaselist_purchasesget_purchaselist_content_purchasesget_payoutsInsights
get_insightsget_analytics_healthget_google_insightsget_commerce_insightsget_academic_insightsget_insights_seriesget_content_insightsget_content_salesReports and safety
create_safety_caseget_safety_case_statuslist_safety_caseslist_safety_subjectslist_safety_subject_casesget_safety_caseupdate_safety_caseMinor accounts
begin_child_sponsorshiplist_guardian_linksrevoke_guardian_linkdispute_guardian_linktransfer_primary_guardianset_minor_usage_limitget_minor_usagecomplete_adulthood_transitionMinor safety
create_minor_safety_caselist_minor_safety_casesupdate_minor_safety_caseOffers
review_offer_for_minorslist_offerslist_content_offerscreate_offerget_offerupdate_offerrotate_offer_access_linkrevoke_offer_access_linkduplicate_offerset_primary_offerarchive_offerMedia
upload_imageContents
list_contentscreate_contentget_contentupdate_contentdelete_contentpublish_contentduplicate_contentget_document_schemaget_content_documentreplace_content_documentLearner delivery
get_learner_contentLearners and enrollment
list_learnerslist_content_learnersenroll_learnerunenroll_learnerupdate_learnerreset_learner_progressreset_learner_progress_bulkget_learner_masterylist_enrollment_requestsget_pending_request_summaryapprove_enrollment_requestreject_enrollment_requestCohorts and discussion
list_content_cohortscreate_cohortupdate_cohortdelete_cohortadd_cohort_memberremove_cohort_memberset_cohort_member_rolelist_cohort_discussioncreate_cohort_discussion_postresolve_discussion_postpin_discussion_postdelete_discussion_postIntake forms
list_intake_formscreate_intake_formget_intake_formupdate_intake_formdelete_intake_formCampaigns
list_campaignscreate_campaignupdate_campaigndelete_campaignTeams
list_teamscreate_teamget_teamupdate_teamdelete_teamadd_team_memberremove_team_memberset_team_member_rolesAffiliates
get_affiliate_programupdate_affiliate_programlist_affiliatesapprove_affiliateblock_affiliateset_affiliate_commissionsettle_affiliateLinks
list_tracked_linkscreate_tracked_linkget_tracked_linkupdate_tracked_linkarchive_tracked_linkdelete_tracked_linkget_tracked_link_insightsReviews
list_content_reviewsIntegrations and assistants
get_integrationsget_google_integrationauthorize_google_integrationreconnect_google_integrationlist_google_resourcesselect_google_resourceactivate_google_integrationdisable_google_integrationconfigure_google_server_deliveryclear_google_server_deliveryselect_google_reporting_resourceauthorize_google_reportingclear_google_reporting_resourcedisconnect_google_integrationget_google_oauth_resultauthorize_google_gtm_managementpreview_google_gtm_changespublish_google_gtm_changesconnect_whatsapp_integrationreplace_whatsapp_credentialsupdate_whatsapp_settingsdelete_whatsapp_integrationtest_whatsapp_integrationdelete_video_integrationcreate_video_uploaddelete_payment_integrationMCP
list_mcp_connectionsrevoke_mcp_connectionWebhooks
list_webhookscreate_webhookupdate_webhookdelete_webhooklist_webhook_deliveriestest_webhookAuthoring with AI
The most powerful pair of tools is get_content_document and replace_content_document: together they let an assistant read and rewrite a complete recursive draft. Every content uses the same schema and can combine learning blocks with reference blocks that point to other contents. Offers independently decide whether a content is sellable. The loop is always read the schema, read, modify, write:
get_document_schemareturns the shared JSON schema, limits, and examples. Call it before touching a document.get_content_documentreturns{ version: 2, header, body }, the complete structured document.- The assistant edits typed blocks and attributes while preserving stable ids.
replace_content_documentwrites the modified draft back, replacing it whole.publish_contentmakes it live. References must point to same-organization contents without cycles; learner navigation uses the published manifest.
This makes prompts like rewrite the introduction to be friendlier or add a five-question quiz to the second referenced content work end to end.
For risk-free experiments, duplicate_content first: the copy gets its own draft with no learners attached, so an assistant can restructure it aggressively while the original stays untouched.
Example prompts
Once connected, these are the kinds of requests that resolve to one or two tool calls:
- Create a 20% coupon called LAUNCH20 for the Zero to Production course, limited to 50 uses.
- Enroll ana@example.com in the Onboarding course and put her in the March cohort.
- Summarize this month's sales against last month and flag any refunds.
- Draft a new section on error handling after the API basics section, matching the course tone.
- Who signed up this week but has not started anything yet?
- Approve all pending enrollment requests that answered yes to the prerequisite question.
Limits and errors
- Rate limits are shared with the REST API: 240 reads/min and 60 writes/min per credential. When a call is throttled, the API's rate-limit message comes back inside the tool result.
- Failed calls are not protocol errors — they return as tool results flagged
isError, carrying the HTTP status and the API's error message, so the assistant can read the reason and adjust. - Stateless — the server keeps no session between calls. Every call authenticates independently, and there is nothing to resume or clean up.
Protocol notes
For client authors: the transport is Streamable HTTP with plain JSON responses — the server supports initialize, tools/list, and tools/call, and does not open an SSE stream. Unauthenticated requests get a 401 with a WWW-Authenticate challenge, which triggers OAuth discovery and dynamic client registration automatically in compliant clients — that is the whole magic behind the browser sign-in.