All clients use the same server URL and the same browser-based OAuth consent
flow: no API keys, no manual token handling.
Claude Desktop
Cursor
VS Code
Windsurf
- Open Claude Desktop → Settings → Developer → Edit Config.
- Add the Mavel server:
- Restart Claude Desktop. The first tool call triggers the OAuth flow.
- Approve in the popup. Tokens are stored in Claude Desktop’s keychain.
Slash commands (/weekly_pulse, /competitor_radar, …) are available in
the prompt picker; each takes project_id as its first argument.
- Cursor → Settings (⌘,) → Features → MCP.
- Add a new server: set Name to
mavel, URL to
https://mcp.mavel.ai/api/mcp, and Type to streamable-http.
- Save, then click Authorize, which opens the OAuth consent flow in
your browser.
- Approve. Cursor stores the access token and refreshes it automatically.
Use @mavel in chat to invoke tools; slash prompts appear in the prompt
picker.Requires an MCP-capable extension.
Cmd+Shift+P → MCP: Add Server.- Choose Streamable HTTP, URL
https://mcp.mavel.ai/api/mcp.
- The extension handles the OAuth flow and persists the token in VS
Code’s secret storage.
- Tools and prompts appear in the MCP panel.
- Settings → MCP Servers → Add.
- Type: HTTP. URL:
https://mcp.mavel.ai/api/mcp.
- Approve in the OAuth popup that opens.
- Tools and prompts are immediately available in the agent panel.
On the consent page you choose whether to grant mcp:write. Read-only
access (mcp:read) is enough for reports and analyses; grant write access
only if you want your assistant to create or edit prompts, brands, topics,
and tags on your behalf.
Managing connected agents
Every agent you connect appears in the dashboard under
Settings → Connected agents. Each
row is one client, showing the access it was granted and when it connected.
- Revoke disconnects an agent right away. Its next tool call gets a
401
and it stops working. Nothing is deleted, so you can reconnect any time by
running the setup flow again (for example, re-add the server, or run /mcp in
Claude Code) and approving on the consent page.
- An agent you have not used for 90 days drops off the list automatically once
its refresh token expires. No action is needed.
Revoking here is the recommended way to disconnect a lost or untrusted client.
If you are building a custom client, you can also revoke a single token
programmatically with POST /api/mcp/oauth/revoke (RFC
7009). 
