MCP connectors

Last updated October 14, 2026

claude.ai, Claude Desktop, ChatGPT and Claude Code can use remote MCP servers as connectors: you paste a URL and the app signs you in. Tempr gives you that URL for the MCP servers you've set up in Tempr. The app signs you in to Tempr, not to each server, and every tool call goes through Tempr with your stored credentials, your organization's Tool Packs and MCP guardrails, and the request log, as calls from Tempr's own IDE extensions and CLI do.

1. Set up a remote MCP server in Tempr

   Add it under MCP credentials in the Portal, for yourself or, as an owner or admin, for your organization. Only remote servers can be connectors; local (stdio) servers run in your editor. See MCP servers.

2. Copy a connector URL

   The Portal's MCP connectors page lists them: https://api.temprhq.io/mcp/connector for all your servers at once, or https://api.temprhq.io/mcp/connector/{server} for one. Everyone uses the same URLs; the sign-in decides whose servers you reach.

3. Add it to the app and sign in

   The app opens Tempr's sign-in page. Sign in as you usually do (password, emailed code, authenticator app or your organization's single sign-on), check which app is asking and where it will send you back, and allow it.

Adding it to each app

All servers, or one

The all-servers URL is one connector with every server's tools, each named after its server: github__create_issue, jira__search. It's the simplest to set up, and a new server shows up in it without adding anything. A single server's URL keeps the tools' own names, and lets you turn one server on or off in the app on its own. Tool calls are logged per server either way.

What you can reach is what you could reach from Tempr's IDE extensions: your own servers, or as an organization member, the organization's servers your Tool Packs give you, with its MCP guardrails on arguments and results. A server that signs each member in to their own account (per-member sign-in) asks you to sign in to it the first time you use one of its tools.

Connected apps

The MCP connectors page lists the apps you've signed in, with when you connected each and when it last used Tempr, and disconnects one at once: its tokens stop working on its next call. An app stays connected until you disconnect it, an admin does, or you leave the organization whose servers it reaches. Connecting it again skips the consent screen, unless it asks for servers you didn't approve. Its access token lasts an hour and it renews it with a refresh token, which changes each time it's used and lapses after 30 days unused.

For organization owners and admins

On the same page, owners and admins see every member's connected apps and can disconnect any of them, and set three things for the organization. Each change and each new connection is in the organization's audit log.

You can also give a server's tools your own titles and descriptions, under Tool Packs: Tempr shows yours in place of the server's in every tool list it passes on, connectors included.

Enterprise Managed Auth

With Enterprise Managed Auth (MCP's enterprise-managed authorization, also known as Cross App Access), an app such as Claude Enterprise signs members in to Tempr with an identity assertion from your company's identity provider, with no consent screen. Tempr accepts an assertion when it's signed by the issuer you set, addressed to Tempr (https://portal.temprhq.io/), issued to the app presenting it, issued in the last ten minutes and not used before, and names an active member of the organization by an email on one of its verified single sign-on domains (and not one the provider says is unverified). The app gets an access token only, and asks your identity provider for a new assertion when it runs out. Set up the app and Tempr as a pair in your identity provider as its documentation describes.

For developers: how sign-in works

Tempr follows the MCP authorization spec (2025-06-18 and later), with OAuth 2.1.

• A connector URL without a token answers 401 with WWW-Authenticate: Bearer resource_metadata="https://api.temprhq.io/.well-known/oauth-protected-resource/mcp/connector…", scope="mcp". That protected resource metadata (RFC 9728) names the authorization server, https://portal.temprhq.io/.
• The authorization server's metadata is at https://portal.temprhq.io/.well-known/oauth-authorization-server (RFC 8414). It supports the authorization code grant with PKCE (S256 only), refresh tokens (offline_access), resource indicators (RFC 8707), the iss authorization response parameter (RFC 9207), and the JWT bearer grant for identity assertions.
• Clients identify themselves with a Client ID Metadata Document (their client_id is its HTTPS URL), or register with dynamic client registration (RFC 7591) at https://portal.temprhq.io/oauth/register. Public clients use none; a registered client can ask for client_secret_basic or client_secret_post. Loopback redirect URIs match on any port.
• Tokens are for one connector URL (the resource you ask for) or for all of them; the all-servers URL's token reaches every server. Ask for scope mcp.
• Tokens are opaque. Revoke one at https://portal.temprhq.io/oauth/revoke (RFC 7009).

What's next

• MCP servers: storing servers and their credentials in Tempr, Tool Packs and guardrails.
• Teams & SSO: your organization's single sign-on, which connectors' sign-ins use too.
• Claude Desktop: running Claude Desktop's model calls through Tempr Gateway as well.