Use tenant administration and the guided setup assistant directly from supported MCP hosts. OAuth login, explicit scopes and the signed-in user's permissions keep every connection controlled.
https://<tenant>.id.tuurio.com/mcphttps://<tenant>.id.tuurio.com/mcp/setupStreamable HTTP MCP without a proprietary bridge or copied API token.
Browser login and explicit consent instead of secrets in configuration files.
Tokens and tools stay bound to the selected tenant and effective user rights.
Inspect configuration, guide setup and perform approved changes without exposing secrets to prompts or config files.
List users, clients, roles and effective settings with the permissions of the signed-in user.
Analyze OAuth clients, callbacks and security settings before a change is made.
Use a separate, resource-bound endpoint for the guided tenant onboarding assistant.
Enable mcp:write deliberately; user permissions, production switches and confirmations still apply.
Use /mcp normally and /mcp/setup only during guided onboarding.
Compatible hosts register a public PKCE client automatically; fixed hosts use an MCP client from the admin portal.
Tuurio opens in the browser so the user can verify tenant, host and requested scopes.
The visible tools follow the token scopes and the user's effective Tuurio permissions.
Use the generated tenant configuration with the major MCP-capable clients.
Client menus and OAuth capabilities can change. The tenant admin portal provides current, host-specific instructions.
Replace the tenant placeholder, then complete login and consent in the browser.
Developer detailscodex mcp add tuurio-auth --url https://<tenant>.id.tuurio.com/mcp
codex mcp login tuurio-auth --scopes mcp:connect,mcp:writeOmit mcp:write for read-only access. Never place access tokens, authorization codes or client secrets in an MCP configuration file.
Automatic clients send their exact redirect URI during registration. For hosts with a fixed callback, choose MCP Client in the OAuth client editor and select the matching preset.
No. Hosts that support compatible dynamic client registration create their public PKCE client during login. Create an MCP client manually only when the host uses a fixed callback or asks for a client ID.
Use the exact callback shown by the host. In the MCP client editor, a host preset can fill known callbacks. If the host registers automatically, you do not enter one yourself.
It is reserved for the guided tenant setup assistant and uses a separate resource-bound access token. Normal administration uses /mcp.
Only when mcp:write was requested and approved, the user has the required permission, and production write tools are enabled. Read-only is the safer default.
No. The host completes OAuth in the browser and stores its authorization securely. Tokens, authorization codes and client secrets do not belong in copied configuration snippets.