OpenWork MCP Gateway

https://api.openworklabs.com/mcp/agent

​

Set up your client

​

In the OpenWork desktop app

​

Client support status

​

OpenCode setup

{
  "mcp": {
    "openwork": {
      "type": "remote",
      "enabled": true,
      "url": "https://api.openworklabs.com/mcp/agent",
      "oauth": {}
    }
  }
}

opencode mcp auth openwork

opencode mcp logout openwork
opencode mcp auth openwork

​

Codex setup

codex mcp add openwork --url https://api.openworklabs.com/mcp/agent
codex mcp login openwork

codex mcp logout openwork
codex mcp login openwork

​

Cursor setup-only guide

https://api.openworklabs.com/mcp/agent

​

ChatGPT setup-only guide

https://api.openworklabs.com/mcp/agent

​

Organization selection

​

What you can ask the agent

• Check your cloud identity — “Which OpenWork Cloud organization am I connected to?” The agent reports the organization, your account, and your role.
• Invite teammates — “Add omar@example.com to my organization.” The agent sends the invitation, updates the allowed email domains when needed, and surfaces seat-limit billing rules instead of failing silently.
• Manage teams — “Assign Priya to the Sales team.” Works for active members; the agent explains when someone still has a pending invitation.
• Share skills with your org — “Create a skill that writes weekly status reports and share it with my whole organization.” The agent writes the skill inside a plugin, adds the plugin to a Collection, and grants the Collection org-wide — teammates find the assigned skill in Settings > Library.

​

OAuth and protocol details

• The protected resource is exactly https://api.openworklabs.com/mcp/agent.
• Clients discover OAuth metadata with RFC9728 protected-resource discovery.
• The authorization server and browser sign-in origin is https://app.openworklabs.com/api/auth.
• OAuth authorize and token requests must include exactly one resource value: https://api.openworklabs.com/mcp/agent.
• Clients that need registration use dynamic client registration as a fallback during discovery.
• PKCE is required for public/dynamic clients, and only the S256 code challenge method is supported.
• Redirect URIs must be HTTPS callbacks or HTTP loopback callbacks such as http://127.0.0.1:<port>/callback. Private-use callback schemes are not accepted for public OAuth clients, except exact allowlisted callbacks for known native clients — currently Cursor Desktop’s cursor://anysphere.cursor-mcp/oauth/callback — with PKCE S256 enforced.

​

Token lifetime and refresh

• Public OAuth access tokens are JWTs signed and validated with EdDSA. The issuer is exactly https://app.openworklabs.com/api/auth, the audience is exactly https://api.openworklabs.com/mcp/agent, and access tokens expire after 45 minutes.
• Refresh tokens are opaque rotating grants with a 30-day inactivity window and a 30-second rotation overlap for near-simultaneous refreshes.
• Each refresh revokes the previous refresh grant; because OpenWork stores only token hashes, a replay during the overlap can issue another successor instead of returning prior plaintext.
• Successor grants remain normal rotating grants. If an old refresh grant is replayed after the overlap, expired, or revoked, the client may receive invalid_grant and the client/user refresh-token family is revoked. Reconnect by logging out of the MCP entry and authenticating again.
• Access is rechecked against the active OpenWork session and organization membership, so removing a member or revoking the session cuts off MCP access.

​

What the gateway exposes

• search_capabilities searches the capabilities available to the signed-in member.
• execute_capability runs an exact capability name returned by search_capabilities.

​

MCP token scopes

​

MCP Apps

​

Troubleshooting

• 401 missing or invalid token: run the client’s auth/login command again. Confirm the client points to https://api.openworklabs.com/mcp/agent.
• 403 membership or scope error: confirm you selected the right organization and still have membership and required permissions there.
• invalid_grant: the refresh grant was expired, revoked, or replayed after the 30-second rotation overlap. Run logout, then auth/login again.
• 429 rate limit: wait for the response’s Retry-After value before retrying.
• Support requests: include the response X-Request-Id header plus any JSON body MCP referenceId or OAuth reference_id field so OpenWork support can find the server-side trace.

​

Requirements

• An OpenWork Cloud account and organization.
• An MCP client that supports remote Streamable HTTP MCP servers.
• OAuth support in the MCP client, including browser-based authorization.