Connecting to Keeping's MCP server

How to connect to Keeping's MCP server.

Prerequisites

• A Keeping account with an active subscription

• MCP access enabled for your organization. Billing Admin's can enable MCP Access in your Organization Settings.

• 

  Billing Admins Can Enable MCP Access

Connecting from Claude Desktop

1. Open Claude Desktop and go to Settings (gear icon)

2. Select Integrations or MCP Servers

3. Click Add MCP Server

4. Enter the following server URL:

   https://mcp.keeping.com/

5. Claude will open a browser window asking you to sign in with your Google account (the same one you use for Keeping)

6. Review the requested permissions and click Allow

7. You're connected! Try asking Claude something like "Show me my open tickets"

Connecting from Claude Code (CLI)

Add the Keeping MCP server to your Claude Code configuration:

claude mcp add keeping-mcp --transport http https://mcp.keeping.com/

Claude Code will handle OAuth authentication automatically — you'll be prompted to sign in via your browser on first use.

Connecting from Cursor

1. Open Cursor and go to Settings → MCP

2. Click Add new MCP server

3. Set the transport type to HTTP

4. Enter the server URL:

   https://mcp.keeping.com/

5. Cursor will prompt you to authenticate via your browser

6. Sign in with your Google account and authorize access

Connecting from ChatGPT

ChatGPT supports MCP connections through its Actions or Connectors feature (availability may vary by plan):

1. In a ChatGPT conversation, look for the MCP or Connect tools option

2. Enter the Keeping MCP server URL:

   https://mcp.keeping.com/

3. Authenticate via the browser popup using your Google account

4. Once connected, ChatGPT can use your Keeping tools

Connecting from Other MCP Clients

Any MCP-compatible client can connect to Keeping using:

• Server URL: https://mcp.keeping.com/

• Transport: Streamable HTTP

• Authentication: OAuth 2.1 with PKCE (handled automatically by most clients)

The server supports OAuth Discovery via these standard endpoints:

• https://mcp.keeping.com/.well-known/oauth-authorization-server

• https://mcp.keeping.com/.well-known/oauth-protected-resource

Connecting with a Personal Access Token

If your MCP client can't complete the OAuth 2.1 browser sign-in — for example a script, a server-side automation, or a custom-built client — you can authenticate with a Personal Access Token (PAT) instead. A PAT is tied to your own agent account and carries the same mcp:read and mcp:write permissions you have in Keeping.

Prerequisites

• MCP access must be enabled for your company. If you don't see the option below, ask a Keeping admin to turn on MCP access in your company settings.

Generate your token

1. In Keeping, open Settings and select the Preferences tab.

2. Under MCP Personal Access Token, click Generate Token.

3. Copy the token immediately - it starts with kp_at_ and is shown only once. Treat it like a password and store it somewhere secure. If you lose it, generate a new one.

Use your token

Send the token as a Bearer token in the Authorization header on every request to https://mcp.keeping.com/:

Authorization: Bearer kp_at_your_token_here

Most MCP clients have a field for a bearer token or a custom header. For a hand-built client, set the header on each request - for example:

curl https://mcp.keeping.com/ \
  -H "Authorization: Bearer kp_at_your_token_here" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"my-client","version":"1.0"}}}'

Revoke or replace a token

• Generating a new token from the Preferences tab automatically revokes your previous one.

• To turn off access entirely, click Revoke Token on the same screen. Revoking takes effect immediately.

"Authentication failed" or 401 errors

• Confirm the Authorization header is exactly Bearer followed by your token, with no extra spaces or quotes.

• The token may have been revoked or replaced by a newer one — generate a fresh token and try again.

• If all tokens are rejected, MCP access may have been disabled for your company; contact a Keeping admin or [e-mail].

Permissions & Scopes

When you connect an AI tool, you'll be asked to authorize one or both of these permission scopes:

• mcp:read — Access to all read and analytics tools

• mcp:write — Access to all write tools

You can grant read-only access if you only want your AI assistant to retrieve information without making changes.

Your AI assistant will only be able to access the mailboxes and data that your Keeping account has permission to view. Existing team permissions are fully respected.

Troubleshooting

"Authentication failed" or 401 errors

• Your access token may have expired. Most MCP clients refresh tokens automatically — try disconnecting and reconnecting.

• Make sure you're signing in with the same Google account you use for Keeping.

"Access denied" or 403 errors

• MCP access may not be enabled for your organization. Contact [e-mail] to enable it.

• Your Keeping subscription may have lapsed. Check your subscription status in Keeping settings.

"Tool not found" or missing tools

• Analytics tools require a Premium Reporting subscription. Upgrade at keeping.com/pricing.

• Write tools require the mcp:write scope. Re-authorize with both read and write permissions.

Connection drops or timeouts

• The MCP server enforces rate limits to ensure stability. If you're making many requests in quick succession, wait a moment and try again.

• Check that your network allows outbound HTTPS connections to mcp.keeping.com.

"Mailbox not found" or empty results

• Your AI assistant can only access mailboxes your Keeping account has permission to view. Check your mailbox permissions in Keeping settings.

Still need help?

Contact us at [e-mail].

Authentication & Security

The Keeping MCP server uses OAuth 2.1 with PKCE for authentication — the same standard used by major platforms like Google and GitHub. Here's what that means for you:

• You sign in with Google — the same account you use for Keeping. No separate passwords or API keys to manage.

• Access tokens expire after 1 hour and are automatically refreshed, so your connection stays active without re-authenticating.

• Refresh tokens are valid for 90 days. After that, you'll need to re-authorize.

• Tokens are encrypted — Keeping never stores your raw tokens. Only a secure hash is kept.

• Replay protection — if a token is ever intercepted and reused, Keeping automatically revokes the entire token family.

• You can revoke access at any time by contacting [e-mail].