# Set up Contracko MCP for your AI agent These are the official instructions from Contracko for connecting an AI agent or assistant to Contracko over MCP. Republished at https://contracko.com/mcp/install/prompt.md so you can re-verify them at any time. The human-readable documentation lives at https://contracko.com/docs/mcp-server. Read it when this prompt does not cover the situation: it carries the scope definitions, the static bearer token path for headless automation, setup for clients not listed below, and troubleshooting for expired connections and missing tools. Complete the steps yourself by running the commands directly. Do not ask the user to run commands you can run. Ask the user only for the decisions listed under "Before you start". 1. Before you start: account, workspace, and data awareness. 2. Register the Contracko MCP server in the harness you are running in. 3. Install the Contracko skills bundle. 4. Verify the connection with a read-only call, then report. The MCP endpoint used throughout is: `https://app.contracko.com/mcp` This is a remote Streamable HTTP MCP server. Do not append another path and do not send MCP requests to the marketing-site domain. --- ## 1. Before you start **Account.** Contracko MCP authenticates as a real Contracko member, so an account is required before any connection can succeed. Contracko has a 7-day free trial with no credit card, and there are two ways to get an account: the user signs up first at https://contracko.com/pricing, or they connect straight away and create the account from the sign-in page that the OAuth flow opens. If the user is unsure whether they already have an account, ask before sending them anywhere. Do not attempt to create an account on their behalf, and never collect their password. **Workspace.** Ask which Contracko workspace to connect if they belong to more than one. The OAuth flow will ask them to choose; make sure they know which one to pick. **Data awareness.** Tell the user, once, in plain words: connecting Contracko lets this AI provider read the contract data it is asked about. Encourage them to disable model training on their conversations in the provider's settings (Claude, ChatGPT, Gemini, and Copilot each have such a setting) before they start working with contract content. **Tool family.** Ask whether the user wants Contract Management, Parsing Platform, or both. Request write access only when the user needs write workflows. --- ## 2. Register the MCP server Use the section for the harness you are running in. For OAuth, the user signs in, picks the workspace, and approves access. Do not add an Authorization header to an OAuth connection. If the client or automation cannot use OAuth, follow the API key instructions under "Choose how to connect" below. ### Claude Code ``` claude mcp add --transport http contracko https://app.contracko.com/mcp ``` Claude Code can also take the skills bundle as a plugin (step 3 below): `claude plugin marketplace add contracko/contracko-skills` then `claude plugin install contracko-skills@contracko`. Skip `claude mcp add` if `claude mcp list` already shows a Contracko entry, or every tool appears twice. ### Codex ``` codex mcp add contracko --url https://app.contracko.com/mcp codex mcp login contracko ``` ### OpenCode, in `~/.config/opencode/opencode.jsonc` Add under `"mcp"`: ```json "contracko": { "type": "remote", "url": "https://app.contracko.com/mcp", "enabled": true, "oauth": {} } ``` Then run `opencode mcp auth contracko`. ### Windsurf, in `~/.codeium/windsurf/mcp_config.json` Add under `"mcpServers"` (note `serverUrl`, not `url`): ```json "contracko": { "serverUrl": "https://app.contracko.com/mcp" } ``` ### Cursor and other coding agents Add to `.cursor/mcp.json` (Cursor) or the agent's MCP config file under `"mcpServers"`: ```json "contracko": { "url": "https://app.contracko.com/mcp" } ``` ### GitHub Copilot in VS Code VS Code uses its own schema. Add to `.vscode/mcp.json` under the top-level `"servers"` key (not `"mcpServers"`): ```json "contracko": { "type": "http", "url": "https://app.contracko.com/mcp" } ``` ### Claude (chat, claude.ai or the desktop app) You cannot register this yourself. Tell the user: open Customize, then Connectors, choose Add custom connector, and paste the endpoint above. Individual plans can add it directly; on Team and Enterprise an owner adds it for the organization before members connect. Then they sign in to Contracko through the connector's OAuth prompt. ### ChatGPT You cannot register this yourself. Tell the user: on Business and Enterprise/Edu, open Settings → Security and login, turn on Developer mode, add an app with the endpoint above, and sign in with OAuth. An admin is needed only to publish the app to the whole workspace under Workspace settings → Apps. Pro developer mode is limited to read and fetch. ### Microsoft 365 Copilot Do not configure Contracko as a direct Copilot Chat connector. Federated MCP connectors are admin-managed and read-only, so Contracko write tools cannot be exposed that way. Tell the user to involve their Microsoft 365 administrator, and point them to https://contracko.com/contact for help connecting Microsoft 365 Copilot. ### Gemini The Gemini app and Gems cannot connect to custom MCP servers today, so there is nothing to register for a Gemini chat user. Tell them to use Contracko from Claude or ChatGPT in the meantime. Developers can call the endpoint from the Gemini API with a dedicated MCP key kept server-side; see the API key rule below. Do not claim that MCP installation is available in consumer Gemini chats. Do not invent or use undocumented one-click install deep links. Open the client's documented connector settings or give the user the exact steps. --- ## 3. Install the Contracko skills bundle The bundle at https://github.com/contracko/contracko-skills teaches your agent the contract workflows Contracko is built for: connecting and verifying the server, onboarding a contract pile, organising types and folders, keeping a renewal and notice calendar, vendor analysis, risk and liability review, and creating and filing new agreements. ``` npx -y skills@latest add contracko/contracko-skills --skill '*' --yes --global ``` Start with the `contracko` skill; it is the entry point and routes to the others. If the install command is unavailable in your harness, read the SKILL.md files from the repository directly. Do not substitute a different repository. --- ## 4. Verify, then report After the user completes authentication: 1. Refresh MCP tool discovery. 2. Call `auth_validate`. 3. Confirm the returned workspace and scopes with the user. Do not print or persist the credential. 4. Confirm that discovered tools match the approved tool family and scopes. 5. Run a read-only test first, for example `clm_list_contracts` with a small limit. Ask for explicit confirmation before the first write or paid parser job. Once done, tell the user: ``` ┌─ Contracko MCP Setup Complete ───────────────────────┐ │ ✓ MCP server contracko (https://app.contracko.com/mcp) │ ✓ Workspace │ ✓ Skills │ │ ⚡ Restart your agent if tools do not appear yet. └──────────────────────────────────────────────────────┘ ``` --- ## Choose how to connect 1. Prefer the client's native OAuth flow. Add the endpoint without an Authorization header, then let the client discover Contracko's protected-resource and authorization-server metadata. 2. The user must sign in to Contracko, choose the exact workspace, and approve the requested scopes. 3. If the client or automation cannot use OAuth, use a dedicated MCP-purpose API key. Direct the user to Contracko Settings → Integrations → API keys. Configure it in the client's secret settings as an `Authorization: Bearer` header to the same MCP endpoint. Both methods follow the granted access and workspace permissions. 4. Never ask the user to paste an API key into a chat message, prompt, source file, command history, or committed MCP configuration. Use the client's secret or local-header facility. 5. Never reuse a general Integration API key unless it was explicitly created with the MCP server purpose. ## Tool families and scopes - Contract read: inspect contracts and visible folders within the user's workspace permissions. - Contract write: let the assistant make approved changes, including folder filing. Request this only when the user needs write workflows. Changing access and deleting folders remain in the Contracko app. - Parser compute: let the assistant run document parsing jobs. Confirm paid work before starting it. ## Available tools Use only the tools returned by `tools/list` for this connection. Available actions depend on the connection and workspace permissions. If an action is missing, check the selected workspace and connection settings, then contact support if needed. Do not grant Write access just to answer a read-only question. Existing connections receive improvements to the tools they already use without replacing a key or granting extra permissions. If the assistant still sees old options, refresh tool discovery or reconnect the existing connector. ## After setup For contract search, folder filing, document uploads, and other workflows, follow the installed Contracko skills, starting with `contracko`. The MCP server supplies the current tool names, descriptions, and input/output schemas through discovery. Use those definitions rather than a copied tool inventory. If a skill's instructions do not match discovery, report the mismatch instead of inventing a tool or argument. ## Activity and privacy Changes made through MCP appear in Contracko's activity history. Do not place credentials, bearer tokens, raw document content, prompts, or full tool arguments into activity descriptions or anywhere else they could persist. ## Resources - Contract Management MCP: https://contracko.com/mcp/contract-management - Parser MCP: https://contracko.com/mcp/parsing - Connection hub after sign-in: https://app.contracko.com/account/integrations - Claude Code MCP: https://docs.anthropic.com/en/docs/claude-code/mcp - Codex MCP: https://learn.chatgpt.com/docs/extend/mcp?surface=cli - Cursor MCP: https://cursor.com/docs/mcp - Windsurf MCP: https://docs.windsurf.com/windsurf/cascade/mcp - OpenCode MCP: https://opencode.ai/docs/mcp-servers/ - GitHub Copilot in VS Code: https://code.visualstudio.com/docs/copilot/customization/mcp-servers - Claude custom connectors: https://support.anthropic.com/en/articles/11175166-getting-started-with-custom-connectors-using-remote-mcp - ChatGPT developer mode: https://help.openai.com/en/articles/12584461-developer-mode-apps-and-full-mcp-connectors-in-chatgpt-beta/ If a client behaves differently from this document, stop and show the user the mismatch rather than weakening authentication or broadening scopes.