MCP server setup
Connect your AI assistant to Aplas using the MCP server
Two ways to connect
An assistant reaches Aplas over MCP with one of two credentials:
| Sign in with Aplas | API key | |
|---|---|---|
| What it is | OAuth: the assistant opens a browser, you sign in to Aplas, and it acts as you, with the role you hold in the organization. | A key created in Config → API with a fixed role, sent as a request header. |
| Best for | claude.ai, Claude Desktop, Cursor and VS Code, where each person should act with their own permissions. | Automation, CI, and any client that can only send a static header — including Claude Code today. |
| What it can do | Owners, administrators and authors can read and write; viewers can read; a billing manager gets no tools. | Whatever role the key was created with: ReadOnly or ReadWrite. |
Both work on the same URL. When you sign in, the client id to give your assistant is aplas-mcp; there is no secret.
Which organization?
Signing in connects you to your organization in that region. If your account belongs to several organizations there, the server asks you to name one in the URL: https://api.au.aplas.com/mcp/v1/<organization-name>, using the name that appears in your Aplas URLs. An API key is already tied to one organization and needs no segment.
Creating an API key
- Log in to Aplas and open Config → API.
- Click Create API Key, choose its role, and copy the generated key.
| Role | What the assistant can do |
|---|---|
| ReadOnly | Search, count, and read assets and their relationships. Every tool that changes data is refused. |
| ReadWrite | The above, plus creating and updating assets and grouping them. |
A ReadOnly key is the right default. It lets an assistant answer questions about your estate with no possibility of altering it — useful when you are trying MCP out, or connecting a client you do not fully control.
Keep your API key secure
Your API key provides access to your organization's data. Do not share it publicly or commit it to version control.
Regional endpoint
Aplas is hosted in three regions and the MCP server lives at the same regional host as the REST API, under /mcp/v1:
| Region | MCP URL |
|---|---|
| Australia | https://api.au.aplas.com/mcp/v1 |
| Europe | https://api.eu.aplas.com/mcp/v1 |
| United States | https://api.us.aplas.com/mcp/v1 |
Use the URL that matches your organization's region. To find yours, open the Config dashboard in Aplas — the Data residency card shows your region and API endpoint. The examples below use the Australia URL; substitute your own.
Claude Code
Run the following command in your terminal:
claude mcp add --transport http aplas https://api.au.aplas.com/mcp/v1 --header "Authorization: Bearer YOUR_API_KEY"Claude Code can also sign in, with --client-id aplas-mcp --callback-port 3118 in place of the header, but at the time of writing it still attempts dynamic client registration first and stops there (anthropics/claude-code#67258). Use an API key until that is fixed.
Cursor
- Open Settings > MCP.
- Click Add new MCP server.
- Add one of the following configurations.
To sign in as yourself:
{
"mcpServers": {
"aplas": {
"url": "https://api.au.aplas.com/mcp/v1",
"auth": {
"CLIENT_ID": "aplas-mcp"
}
}
}
}Cursor opens a browser window for the Aplas sign-in the first time it connects.
To use an API key instead:
{
"mcpServers": {
"aplas": {
"url": "https://api.au.aplas.com/mcp/v1",
"headers": {
"Authorization": "Bearer YOUR_API_KEY"
}
}
}
}VS Code (GitHub Copilot)
Create or update the .vscode/mcp.json file in your project. To sign in as yourself:
{
"servers": {
"aplas": {
"type": "http",
"url": "https://api.au.aplas.com/mcp/v1",
"oauth": {
"clientId": "aplas-mcp"
}
}
}
}VS Code opens a browser window for the Aplas sign-in on the first connection. To use an API key instead:
{
"servers": {
"aplas": {
"type": "http",
"url": "https://api.au.aplas.com/mcp/v1",
"headers": {
"Authorization": "Bearer YOUR_API_KEY"
}
}
}
}Claude Desktop, claude.ai and the mobile apps
These connect Aplas as a custom connector. Anthropic's infrastructure calls our server rather than your device, which works because our MCP endpoints are on the public internet.
- Open the add-connector dialog:
- Free, Pro and Max — Customize → Connectors → Add custom connector
- Team and Enterprise — an owner adds it under Organization settings → Connectors → Add → Custom (choose Web if asked for a type); members then connect it from Customize → Connectors
- Enter the MCP URL for your region, for example
https://api.au.aplas.com/mcp/v1 - Open Advanced settings and choose Use your own OAuth client — the dialog pre-selects Register automatically, which Aplas does not accept. Enter
aplas-mcpas the OAuth Client ID and leave the client secret empty - Click Add, then Connect: Claude opens the Aplas sign-in, and after you approve the connection the connector acts as you
- Enable Aplas from the + menu in a conversation
Each person who connects signs in as themselves, so a viewer stays read-only and an administrator can write.
Sharing one API key instead
A connector can also carry an API key through Claude's Request headers (a beta Anthropic is rolling out
gradually): choose the authorization header and enter Bearer YOUR_API_KEY, scheme included. The credential is then
stored once for the connector, so everyone using it shares that key's role — a ReadOnly key is the safer default.
Verifying the connection
Once configured, ask your assistant:
List my Aplas workspaces
A working connection returns your workspaces, each with a short id — its slug.
That request is also the first step of every session. Aplas tools are scoped to one workspace, so
the assistant has to know which one you mean before it can search or write. A good client calls
list_workspaces on its own and then passes the slug to everything else; if yours does not, naming
the workspace in your question ("in the enterprise workspace, how many applications are Retired?")
is enough.
Protocol version
The server implements MCP protocol 2025-11-25, over streamable HTTP with no session state — each call is a self-contained POST carrying its own credential. Any client supporting that revision works; the three above all do.
Troubleshooting
Common issues
- 401 Unauthorized — Your API key is invalid or missing. Verify the key in Config → API and check that the
Authorization: Bearer <key>header is set correctly. A signed-in client that gets a 401 has a sign-in that expired; reconnect it. - Wrong region — API keys and sign-ins are scoped to a single region. If you're hitting the right URL but still getting auth errors, confirm the key was issued in the same region as the URL, or that your organization lives in that region.
- "This account belongs to several organisations" — You signed in to a region where your account has more than one organization. Reconnect using the organization's own URL from the message,
https://api.<region>.aplas.com/mcp/v1/<organization-name>. - "No access to the organisation" — The organization named in the URL is not one your account (or API key) belongs to, or it is spelled differently from your Aplas URLs.
- Connection timeout — Ensure your network allows outbound HTTPS connections to your regional
api.<region>.aplas.comhost. - No tools available — Restart your AI assistant client after adding the MCP server configuration.
- A write was refused — The key is ReadOnly. The refusal names the role the tool required; create a ReadWrite key in Config → API if the assistant should be able to change data.
- The server reports it is unavailable for your organization — Your organization is on the earlier (v1) data model, which this server does not serve; the message says so and points at the REST API that does. See the API overview for which version applies to you.