Connect a client

The server speaks streamable-http at https://mcp.<LMS_HOST>/mcp. Authenticate with your raw MCP key as a Bearer token. The server is stateless — it forwards your key to the facade on every request and holds no secrets.

Claude Code (CLI)

claude mcp add --transport http openedx https://mcp.<LMS_HOST>/mcp \
  --header "Authorization: Bearer <YOUR_MCP_KEY>"

Then claude mcp list to confirm, and call whoami in a session.

Claude Desktop

Desktop has no header field, so bridge with mcp-remote. Put the header value in env — mcp-remote splits args on spaces, so Bearer <key> inline breaks.

{
  "mcpServers": {
    "openedx": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://mcp.<LMS_HOST>/mcp",
               "--header", "Authorization:${AUTH}"],
      "env": { "AUTH": "Bearer <YOUR_MCP_KEY>" }
    }
  }
}

Config path — macOS: ~/Library/Application Support/Claude/claude_desktop_config.json, Windows: %APPDATA%\Claude\claude_desktop_config.json. Restart Desktop after editing.

Cursor / other MCP clients

Any client that supports a remote streamable-http server with a custom Authorization header works directly; clients that only spawn stdio servers can use the same mcp-remote bridge shown above.

Troubleshooting

• 401 “Missing MCP key” — the Authorization: Bearer … header didn’t arrive. Check the bridge env value and that you copied the whole key.
• 403 “requires a staff or superuser account” — the key’s user is no longer is_staff/is_superuser. Authority is re-checked live on every call.
• Missing scope — the key doesn’t carry the tool’s scope. Mint a new key with the scope ticked.