Connecting other MCP clients

Besides Claude and ChatGPT, any MCP client that supports remote servers over HTTP and OAuth sign-in will work – for example IDEs such as Cursor, or the MCP Inspector for testing. This article is for anyone who sets up such a client themselves or builds their own integration.

#Key facts

Server URL

https://dock.at-harbor.com/mcp

Transport

Streamable HTTP, stateless. Every request is a POST with a JSON-RPC message (or a batch), and the response comes back as JSON. There is no session ID and no server stream.

Protocol versions

2025-11-25, 2025-06-18 and 2025-03-26

Methods

initialize, ping, tools/list and tools/call. The server does not offer resources or prompts.

Sign-in

OAuth 2.1 with PKCE (S256). Without a token, the server responds with 401 and points to its metadata in the WWW-Authenticate header.

#Set up a client

1. In your client, add a remote MCP server (often called “Remote”, “HTTP” or “Streamable HTTP”)
2. Enter https://dock.at-harbor.com/mcp as the URL
3. Leave the client ID and secret empty – the client registers itself
4. Start the connection; the sign-in opens in your browser, followed by the LinkHarbor consent page
5. Choose the workspace and permissions and click “Allow”

What the setting is called differs from program to program. In the MCP Inspector, for example, you choose the “Streamable HTTP” transport.

#The OAuth flow in detail

1. The client calls the MCP server without a token and gets 401 with a pointer to the resource metadata
2. It reads the authorization server metadata (endpoints, supported methods, permissions)
3. It registers itself: via Dynamic Client Registration or with a client metadata document at an https URL
4. It opens the browser with the authorization request, including PKCE and resource=https://dock.at-harbor.com/mcp
5. You sign in and decide on the consent page
6. The client exchanges the code for an access token and a refresh token

If a client does not request any permissions, all of them are requested; you can still narrow them down on the consent page. If a refresh token that has already been replaced is used again, LinkHarbor ends the whole connection for security reasons.

#Rules for redirect addresses

• https addresses
• http only for loopback addresses on your own computer (for desktop clients and IDEs)
• Custom app schemes in reverse domain notation
• At most 10 addresses per client, no fragments

If an app sends an address that is not registered for it, LinkHarbor stops: “The app sent a return address that is not registered for it. The request was stopped.”

#Discovery addresses for developers

#Unknown apps

Apps whose redirect addresses are all on claude.ai, claude.com, chatgpt.com or openai.com count as known. Programs on your own computer that return via localhost – such as Claude Code, Codex and IDEs – show the note “LinkHarbor does not know this app. It runs on your own computer. Only continue if you just started it yourself.” on the consent page, and at the bottom “After your choice you return to the app on your computer.” Other unknown web apps show “LinkHarbor does not know this app. Only continue if you started this yourself and trust …” with their address in place of the dots. Both are normal if you have just set up the client yourself. A logo only appears if the app sends one. If you did not start the sign-in yourself, click “Deny”.