Fikst in Claude, for administrators.

You are approving one URL for a whole organisation. Here is what it reaches, who decides what people may do with it, where the data lives, and how to take it away again.

01 Who this page is for

The administrator who approves and rolls out the Fikst connector for an organisation. If you are setting it up for yourself, the shorter connector documentation is the page you want.

02 What you enter

One URL: https://mcp.fikst.cloud/mcp, over streamable HTTP. Every customer uses that same address. Which organisation it reaches is decided by who signs in, never by the URL, so there is no per-tenant endpoint to configure and no environment ID to look up.

03 How sign-in works

OAuth 2.1 with PKCE. Claude registers itself with our authorisation server through dynamic client registration, so in the normal case there are no client credentials for you to create, paste or rotate. Each person then signs in to your own Fikst environment and approves the connection on a consent screen hosted by us. Passwords are never shared with Claude, and the discovery metadata is published at /.well-known/oauth-protected-resource as required by RFC 9728.

04 If your rollout needs fixed client credentials

Some managed deployments prefer a pre-registered client over dynamic registration. Our authorisation server supports confidential clients with a secret (client_secret_basic and client_secret_post), so we can issue a client ID and secret for your organisation on request. Mail info@fikst.app with the redirect URI your deployment uses and we will register one and hand over the credentials through a channel you choose. There is no self-service screen for this yet, deliberately: issuing a long-lived credential for a whole organisation is a conversation, not a button.

05 What the connector can reach

Only the Fikst data of the organisation the signed-in person belongs to. That boundary is enforced in the database with row-level security, not by the arguments a tool is called with, so a caller cannot reach another organisation by asking differently. The connector calls our own API and nothing else: it does not read Claude conversations, memory or files, and it moves no money.

06 Who may do what

Permissions come from the role the person already has in Fikst, not from the connector and not from a setting in Claude. An administrator reaches everything including configuration; a field engineer gets a narrow set of tools for their own work and cannot touch configuration; a role we do not recognise gets the minimum. This means you govern access in one place: change the role in Fikst and the connector follows immediately. The short list a person sees first also follows their role, but it is not a security boundary; the role is.

07 Reading, writing and deleting

Every tool declares up front whether it only reads or also writes, and destructive tools are marked as such, so a client can show that before anything is called. About twenty tools can truly delete something, mostly configuration plus a draft invoice, and they all require an explicit confirmation step: the first call returns a preview of what would go, and nothing happens until it is confirmed. Everything else deactivates rather than deletes, and stays reversible. One exception to what a client sees up front: the gateway tool fikst_run is marked as writing and destructive, because it can run any tool, while the tool it runs keeps its own marks and role check.

08 Ending access

Deactivating someone in Fikst ends their access through the connector at the same moment, because the connector has no identity of its own. Each person can also end their own sessions from their profile in Fikst, on every device at once if they want. Sessions expire by themselves after 30 days without use, and never live longer than 90 days regardless of use.

09 Where the data is and what we log

Your Fikst data is stored in a database in Ireland, within the European Union. When AI features are used, including through the connector, the content they need is processed outside the European Economic Area, as the data processing agreement sets out. We keep an audit trail of changes made through the connector, attributed to the person who made them, as for changes made in the interface. That includes configuration, such as templates and teams, and the audit data also records which tool made the change. We do not log the contents of your Claude conversations. The details, including retention and sub-processors, are in our data processing agreement, which we send on request.

10 Rate limits and availability

Requests to the connector are rate limited per user, 120 a minute by default. Our public API has its own limit. The server is externally monitored and we are alerted when it stops answering.

questions before you approve this, or need fixed client credentials? mail info@fikst.app. the end-user version of this page is the connector documentation.

Last updated: 19 October 2026