Dureach

Connect an AI client via MCP

Connect an external MCP client to Dureach over streamable HTTP, complete OAuth consent, and call tools/list and tools/call safely.

Dureach exposes a read-and-action MCP server at https://app.dureach.com/mcp for external MCP clients. The client completes OAuth consent, calls tools/list to discover granted tools, then calls tools/call with a dureach.* tool name and typed arguments.

Tool results are transferred to the external client and may be processed or retained by its provider. Review the provider’s data handling, retention, and access terms before connecting. Request only the fields needed for the job; keep contact details and customer records out of shared conversations, screenshots, and logs.

What do you need before connecting?

  1. A Dureach workspace with the agent platform capability enabled. Without it, admission returns plan_capability_required.
  2. An OAuth client that can complete a browser consent grant. MCP accepts OAuth bearer tokens only; REST API keys are rejected on /mcp.
  3. Complete consent in the browser as a workspace member. Store credentials in the client’s protected credential store or a server-side secret manager. Never paste a token into a conversation, shared document, screenshot, or ticket.
  4. An MCP client that supports streamable HTTP with JSON responses (for example, Claude Desktop with an MCP connector, Cursor, or a custom Python client built on the mcp SDK).
  1. Register or open your OAuth client and start an authorization grant for the workspace.
  2. Select only the scopes the client needs (see MCP approvals, policies, and quotas). A reporting client may need only companies:read and trade:read; an outreach client needs additional leads:create or emails:send grants.
  3. Complete consent in the browser as a workspace member. Store credentials in the client’s protected credential store or a server-side secret manager. Never paste a token into a conversation, shared document, screenshot, or ticket.
  4. Send the token as Authorization: Bearer YOUR_OAUTH_ACCESS_TOKEN on every MCP HTTP request. Keep it out of URLs, screenshots, logs, and tickets.
  5. If the client must act for a specific workspace, send X-Workspace-ID with the token workspace ID. A mismatched value returns workspace_context_required.

Check the metadata document at /.well-known/oauth-protected-resource/mcp when your client library needs discovery values.

What endpoint and protocol does the client use?

  • Use https://app.dureach.com/mcp exactly with an MCP client that supports streamable HTTP.
  • Complete OAuth consent for the intended workspace; keep credentials in the client’s protected credential store or a server-side secret manager.
  • For a host or origin rejection, verify the configured connection URL and contact support. Do not remove or forge security headers to bypass a rejection.
  • Keep the response request_id for troubleshooting; never include tokens or result rows in shared logs.

How do you list available tools?

After OAuth consent, call tools/list. Each available tool includes its name and argument schema. Use the returned schemas to validate requests before calling a tool.

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/list",
  "params": {}
}

Use tools/list to discover the tools available to your connection. Availability depends on the granted permissions and workspace access. Start with read scopes; ask a workspace administrator to review missing access rather than requesting broad permissions.

How do you call a tool?

Send a tools/call request with the full dureach. name and an arguments object. Unknown names or names without the prefix return Unknown tool (INVALID_PARAMS):

{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "dureach.companies.search",
    "arguments": {"query": "industrial valves", "page": 1, "limit": 10}
  }
}

A successful result returns one text item containing JSON plus a parsed structuredContent copy. An application failure returns isError: true with {"error": {"code": "...", "details": {...}}, "request_id": "..."}. Store the request_id for support and retry handling. Full argument bounds are listed in the MCP tool reference.

How do you configure common clients?

Claude Desktop or other connector-based clients

  1. Add a streamable-HTTP server with URL https://app.dureach.com/mcp.
  2. Configure OAuth authentication with the client ID from your Dureach OAuth registration and the MCP resource metadata URL.
  3. Complete consent, then verify the connector lists tools starting with dureach..
  4. Start with dureach.workspace.context and dureach.workspace.capabilities before running data searches.

Custom Python client (official mcp SDK)

import os

from mcp import ClientSession
from mcp.client.streamable_http import streamable_http_client

MCP_URL = "https://app.dureach.com/mcp"
TOKEN = os.environ["DUREACH_OAUTH_ACCESS_TOKEN"]

async def main():
    async with streamable_http_client(
        MCP_URL, headers={"Authorization": f"Bearer {TOKEN}"}
    ) as (read, write, _):
        async with ClientSession(read, write) as session:
            await session.initialize()
            tools = await session.list_tools()
            print([t.name for t in tools.tools])
            result = await session.call_tool(
                "dureach.companies.search",
                {"query": "industrial valves", "page": 1, "limit": 10},
            )
            print("Search completed")

Replace the token and query with your own values. Never commit the token to source control.

What checks should run before sharing access?

  1. Call dureach.workspace.context and confirm the returned workspace ID and scopes match the intended workspace.
  2. Call dureach.workspace.capabilities and confirm only expected actions appear.
  3. Run one bounded read (for example, companies.search with limit: 5) and confirm pagination fields.
  4. For write paths, run with dry_run: true first; see MCP approvals, policies, and quotas.
  5. Revoke the token at /oauth/revoke or in Settings → Integrations when access is no longer needed.