On Belay

Connecting Claude (MCP)

Connect Claude once. Every session your team opens inherits your org's context, scoped access, and guardrails.

On Belay speaks to Claude over MCP — the Model Context Protocol, the open standard Claude uses to call an external server's tools. On Belay runs an MCP server at a single URL. When you connect Claude to it, Claude gains a set of tools for reading your org context and acting through your integrations — always inside the permissions you've set.

You don't have to re-explain your org to Claude. You explain it once, in On Belay, and every Claude session your team opens picks it up.

The MCP endpoint is always:

https://app.onbelay.ai/api/mcp

There are three Claude clients you can connect, and the setup differs slightly for each.

Claude.ai (web)

Claude.ai connects to On Belay as a Connector. (Claude.ai calls the MCP server a Connector — that's its word for the server, not for your integrations.)

  1. In Claude.ai, open Settings → Connectors → Add custom connector.
  2. Enter the MCP URL: https://app.onbelay.ai/api/mcp.
  3. Claude.ai will send you through On Belay's sign-in. Approve the connection.

Behind the scenes this is a standard OAuth 2.0 flow. Claude.ai connects as a public client with PKCE (mandatory, S256 only) — so it never holds a long-lived secret. The flow runs through On Belay's authorization server: discovery → dynamic client registration → authorize (where you sign in) → token exchange → connected. Authorization codes are single-use. On Belay confirms who you are before granting any tools. Once approved, the On Belay tools appear in your Claude.ai conversations.

Claude Desktop

Claude Desktop connects the same way as Claude.ai — as a custom Connector over the same OAuth flow.

  1. Open Claude Desktop's Settings → Connectors → Add custom connector.
  2. Enter https://app.onbelay.ai/api/mcp.
  3. Sign in to On Belay and approve.

After approval, the On Belay tools are available in Desktop conversations.

Claude Code (CLI)

Claude Code uses a personal access token instead of the browser OAuth flow. You generate the token in On Belay, then add the server to Claude Code with a single command.

  1. Go to Dashboard → Settings → Claude → Claude Code.

  2. Generate a personal access token. Copy it now — the token is shown once and stored only as a hash, so On Belay can't show it to you again. If you lose it, generate a new one.

  3. Run the pre-filled command (also shown on that page):

    claude mcp add --transport http onbelay https://app.onbelay.ai/api/mcp --header "Authorization: Bearer <token>"

  4. Verify the connection by typing /mcp in Claude Code. You should see onbelay listed.

Treat the token like a password. It carries your access; anyone holding it can act as you within your org's permissions. To rotate it, generate a new token and revoke (delete) the old one from the same settings page — there's no in-place replacement, and multiple tokens can be active at once until you delete them.

Start each session with initialize_session

When a session begins, the first call should be initialize_session. It returns the integration domains you can reach, the integrations available to you, and a session ID that other discovery tools use. Following it with get_my_context loads your functional group memberships, Claude role, and people guidelines.

This is a recommendation, not a gate — the other tools still work if it's skipped. But starting with initialize_session means Claude loads your accessible domains and integrations up front, so it acts with the right context from the first answer instead of guessing.

For the full list of what Claude can do once connected, see the MCP tool reference.

What Claude sees — and what it never sees

Claude sees structured context (your groups, roles, and which integrations and operations you're permitted to use) and the results of calls it makes through On Belay. It never sees a raw credential. API keys stay server-side behind the proxy; the proxy attaches authentication to each call and returns only the response. Set it up once, and that boundary holds for every session.

Related

Questions about connecting Claude? Reach us at hello@onbelay.ai.