Connect Zero to Claude or Cursor
Use ZeroReach's MCP server from Claude, Cursor or any MCP client, with OAuth or an API key.
The MCP server lives at /api/v1/mcp on your ZeroReach host. In the examples below, replace https://your-zeroreach-host with the URL of your ZeroReach instance.
You can connect in three ways:
| Method | Best for | Credential |
|---|---|---|
| Remote connector with OAuth | Claude.ai, ChatGPT and other clients that support MCP OAuth | You sign in and approve; no key to copy |
| Remote with an API key | Cursor, Claude Code and clients that send headers | ro_pat_... |
| Local process (stdio) | Clients that only launch a command | ro_pat_... in an environment variable |
Option 1: OAuth connector (Claude.ai and others)
- In your client, add a custom connector with the URL
https://your-zeroreach-host/api/v1/mcp. - The client discovers ZeroReach's OAuth server and registers itself.
- A browser window opens. Sign in to ZeroReach, choose the workspace the connector may use, and approve.
- The client receives a token. It is short-lived (1 hour by default) and refreshed automatically (refresh tokens last 30 days by default).
The connection gets every scope except admin unless the client asks for fewer, and it is capped by your role. Signing out everywhere or changing your password disconnects it. You can revoke it in the app at any time.
Option 2: Remote with an API key
Create a key under Settings → API keys with the scopes the assistant needs: read scopes for a read-only assistant, write scopes for one that may draft and update. Then point your client at the endpoint with the key as a bearer token.
claude mcp add --transport http zeroreach https://your-zeroreach-host/api/v1/mcp \
--header "Authorization: Bearer $ZEROREACH_API_KEY"{
"mcpServers": {
"zeroreach": {
"url": "https://your-zeroreach-host/api/v1/mcp",
"headers": { "Authorization": "Bearer ro_pat_your_key_here" }
}
}
}{
"mcpServers": {
"zeroreach": {
"type": "http",
"url": "https://your-zeroreach-host/api/v1/mcp",
"headers": { "Authorization": "Bearer ro_pat_your_key_here" }
}
}
}Option 3: Local process (stdio)
core-mcp is a small bridge for clients that launch a local command. It forwards each JSON-RPC message to the server's /api/v1/mcp with your key and prints the answers, so the tools, scopes, compliance gates and audit log are exactly the server's. Nothing runs locally and no database is needed.
| Variable | Default | |
|---|---|---|
REACHOUT_API_KEY | (required) | An API key (ro_pat_...). |
REACHOUT_URL | http://localhost:8000 | The ZeroReach base URL, or the full MCP endpoint. https:// is required except for loopback hosts. |
REACHOUT_MCP_TIMEOUT_SECONDS | 120 | Per-message timeout (1–600). |
{
"mcpServers": {
"zeroreach": {
"command": "core-mcp",
"env": {
"REACHOUT_URL": "https://your-zeroreach-host",
"REACHOUT_API_KEY": "ro_pat_your_key_here"
}
}
}
}The core-mcp binary is built from apps/core/crates/core-mcp (cargo build --release -p core-mcp).
Try it
Ask your assistant:
- "Who am I in ZeroReach?" It runs
whoami: your workspace, local time and scopes. - "What needs me today?" It runs
get_daily_briefing. - "Draft a follow-up to Ana about pricing." It runs
draft_email. The draft waits in Approvals for you to send.
Troubleshooting
| Symptom | Cause |
|---|---|
401 / "An API key is required" | No key, a malformed header, or a revoked or expired key. |
| A tool is missing from the list | The key's scopes don't allow it: tools/list only shows allowed tools. |
Tool error 403 | A missing scope, or an action that needs a signed-in person (such as approving a reply draft). |
Tool error 409 | The server refused the action, for example because a compliance check failed. The detail says why. |
Tool error 429 | The key's request limit (600 per minute by default). |