# Connect MCP

> Connect Claude Code, Claude Desktop or Cursor to the repository over MCP, sign in with OAuth, the list of tools, and what to do when a client does not support CIMD.

InSecLab Papers is a Model Context Protocol (MCP) server: ask Claude or Cursor "what is the status of ISL-2026-0012" without opening the web app. Permissions are the same as on the web: you only see the works you are allowed to see.

## Connection details

| Item | Value |
| --- | --- |
| Endpoint | `https://papers-inseclab.khoi.pro/mcp` (JSON-RPC over HTTP) |
| Sign-in | The app's own OAuth; CLI tokens `papers_…` are not used |
| Client registration | Client ID Metadata Document (CIMD); dynamic client registration (DCR) is off |

## Clients with CIMD support

On the first connection the client opens the browser at the sign-in page, then the **consent** page (showing the client name, lab and permissions). Click **Cho phép** (Allow); the client gets a token that lasts 5 minutes and refreshes it automatically.

**Claude Code**

```sh
claude mcp add --transport http papers https://papers-inseclab.khoi.pro/mcp
# in a Claude Code session: /mcp → choose papers → Authenticate
```

**Claude Desktop**: Settings → Connectors → *Add custom connector* → URL `https://papers-inseclab.khoi.pro/mcp` → Connect.

**Cursor**: add to `~/.cursor/mcp.json`, then enable `papers` in Settings → MCP:

```json
{ "mcpServers": { "papers": { "url": "https://papers-inseclab.khoi.pro/mcp" } } }
```

## Tools

| Tool | Purpose | Writes data |
| --- | --- | --- |
| `works_search` | Search works with the same filters as the web table | No |
| `work_get` | One work: code, title, members, submissions, latest version | No |
| `version_list` | Versions of a work, newest first | No |
| `check_report_get` | Latest results of the 10 checks | No |
| `diff_get` | A 600-second link to the latexdiff PDF | No |
| `latex_flatten` | A 600-second link to the flattened `.tex` file | No |
| `version_upload` | Create a new version (never overwrites) | Yes: the client asks you to confirm |

Errors look like `{ "ok": false, "error": { "code": "not_found", … } }`. A work you cannot access is reported exactly like a work that does not exist.

## Clients without CIMD support

A client reporting `invalid_client` or "client registration failed" does not support CIMD. Ask the **admin** to create a public client (PKCE, no secret) and send you its `client_id`; configure that `client_id` in your app, then connect as above.

For a client that only supports the **device flow**, request a code at `POST /api/auth/device/code` with that `client_id`, open `https://papers-inseclab.khoi.pro/device`, enter the code and click **Cho phép** (Allow). The code lasts 15 minutes and can be approved once; the session must have passed 2FA. The `/device` page is shared with `papers login`, but the two kinds of code are different.