MCP & OAuth

Connect Knotbind to an assistant.

Knotbind is a Streamable HTTP MCP server with OAuth 2.1, PKCE and dynamic client registration. Assistants can sign in without a pasted API key.

OAuth flow

401 challenge
A protected tool call returns WWW-Authenticate pointing to protected-resource metadata.
Discover
The client reads /.well-known/oauth-protected-resource/mcp and /.well-known/oauth-authorization-server.
Register
It posts redirect URIs and a client name to /oauth/register. Public clients use no client secret.
Authorize
Knotbind shows the workspace, app, redirect host and scopes. Owners can grant write; Members get read.
Use
PKCE S256 exchanges a one-time code for a one-hour access token and rotating refresh token.

Manual Claude setup

MCP URL: https://www.knotbind.com/mcp
Authentication: No sign-in if using a kbk_ API key
Authentication: Sign in when needed for OAuth
Transport: Streamable HTTP

Relay detection

Create a relay from the dashboard or POST /api/v1/relay. Add the returned URL to an assistant:

https://www.knotbind.com/relay/<;account>;/<;token>;

The assistant sends its MCP requests to the relay. Knotbind forwards them to your configured MCP server and passes the responses back. On initialize, the client reports its clientInfo.name and version. Knotbind uses that reported name to show a likely client profile as connected.