Skip to main content
Connect a coding agent to Autter’s MCP server so it can read review findings and act on them directly.

​
Before you begin

You need an Autter account, membership in the organization you want to connect, and an MCP-capable client such as Claude Code, Cursor, or Grok. The Autter MCP endpoint is:
Most MCP clients (Cursor, Grok, Claude Code) support Authenticate — no manual token copy-paste.
1

Add the MCP server without a token

Point your client at https://api.autter.dev/mcp only. Do not set an Authorization header yet.
2

Click Authenticate

When the client shows Needs authentication or Authenticate, click it. The client registers itself with Autter (RFC 7591 dynamic client registration), opens your browser, and starts the OAuth flow.
3

Approve in the browser

Sign in to Autter if needed, choose the organization, and click Authorize. Autter creates a scoped access token for that client automatically.
4

Verify

Ask the agent to call whoami, or check that the connector shows as connected in your client’s MCP settings.
OAuth access tokens are scoped personal access tokens stored in Autter. Revoke them anytime under Org Settings → Access Tokens (they appear as MCP — <client name>).

​
OAuth endpoints (for client implementers)

​
Personal access token (CI, scripts, manual setup)

Use a token when your client does not support OAuth or you need a non-interactive credential.
1

Open Access Tokens

Sign in to the Autter platform, open the organization you want to connect, and go to Org Settings → Access Tokens.
2

Start a new token

Select the option to create a token and give it a descriptive name, for example ci-mcp.
3

Restrict it to MCP scopes

Enable the MCP scope restriction and choose the scopes the agent needs:
  • mcp:read for reviews, findings, learnings, and codebase intelligence
  • mcp:write to let the agent reply to comments, resolve threads, re-run reviews, add learnings, and start scans
  • mcp:llm for query_codebase
A restricted token only works with MCP. Leave the restriction off if you also want this token to work with autter login.
4

Copy the token

Copy the token now. Autter shows the raw value only once.
Treat the token like a password. Do not commit it, paste it into a ticket, or share it in chat.

​
Connect with a PAT

Send the token as a bearer credential on every request: Authorization: Bearer autter_pat_xxxxxxxx.

​
Verify the connection

Ask your agent to call the whoami tool, or run a tool list from the MCP Inspector. A working connection returns your user, organization, and the repositories Autter has indexed for that organization. If the connection fails, check:
  • For OAuth: you completed Authorize in the browser and picked the right organization
  • For PAT: the Authorization header is present and the token has not been revoked or expired
  • The token or OAuth grant has the scope the tool requires (mcp:read, mcp:write, or mcp:llm)
A missing or invalid credential returns 401 with a WWW-Authenticate header pointing at OAuth discovery metadata. A tool call outside the token’s scopes returns an insufficient_scope error.

​
Try it

Once connected, ask your agent something like:
Use the Autter MCP tools to fetch the review for PR 142 in owner/repo, fix every finding, then reply to each comment and resolve the thread.
Or, before adding a dependency:
Check whether left-pad has any known vulnerabilities before I add it, using Autter.

​
Manage and revoke access

Open Org Settings → Access Tokens to review token activity (including OAuth-created MCP — … tokens), or revoke access. Revoking a token stops it immediately.

MCP server overview

Read the full tool catalog, scope model, and usage limits.