API and MCP connection

Connect an MCP client and use search, document, original-file, and graph tools safely.

MCP endpoint

The built-in Streamable HTTP MCP endpoint is:

https://your-coglake.example/api/coglake/mcp

Clients that support OAuth discovery can use this URL directly. CogLake publishes protected-resource and authorization-server metadata, supports PKCE, and can dynamically register compatible clients when enabled by the flow.

A generic client configuration using a bearer token looks like:

{
  "mcpServers": {
    "coglake": {
      "type": "http",
      "url": "https://your-coglake.example/api/coglake/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_SCOPED_API_KEY"
      }
    }
  }
}

Prefer OAuth instead of copying an API key into an interactive third-party client.

1Authorize a scoped client

2Search visible knowledge

3Inspect citations and links

4Open permitted originals

5Revoke when finished

Available tools

Tool	Purpose	Required permission
`retrieval.search`	Search visible knowledge with profile and explanation controls	`search:read`
`retrieval.answer`	Produce an answer from visible citations	`search:read`
`retrieval.get_chunk`	Fetch a permitted matching section by ID	`knowledge:read`
`documents.get`	Fetch a permitted document and stable file identity	`knowledge:read`
`documents.get_links`	Follow visible outgoing document links	`knowledge:read`
`documents.get_original_link`	Create a temporary authenticated original-file URL	`knowledge:read`
`graph.get_neighbors`	Traverse permitted graph neighbors with bounded depth and node count	`knowledge:read`

Deep research workflow

An agent can search for an account or topic, open the best document, inspect its links, traverse related nodes, and request the original file when needed. Each step is independently permission-checked, including direct IDs supplied by the client.

Search controls

MCP search and answer calls accept the same retrieval profiles used by Discover, including auto, balanced, exact, semantic, graph, research, and fast. Request an explanation when the client should expose why a result was selected.

Revoke access

Revoke an API key, OAuth application, or connected grant from My settings → Developer access → Agent access. Refresh tokens rotate and are invalid after revocation.