MCP
MCP (Model Context Protocol) lets you connect an AI client — such as Claude, Cursor, or Codex — directly to your workspace. Once connected, the assistant can read and manage your content for you: browse content types, find and read entries, create or update records, upload images, and work with your SEO topic suggestions.
Connecting a client
Every workspace has its own MCP endpoint:
https://flexim.io/api/v1/{workspace}/mcpReplace {workspace} with your workspace slug (for example, main). The ready-to-paste command for each client — with your workspace already filled in — is also available in the CMS under Settings → MCP, so you can copy it directly.
The first time a client connects, your browser opens a Flexim consent page where you authorize it — no manual API key is required. When the client requests background access, Flexim can then renew its short-lived access token without reopening the browser. This authorization lasts for up to 30 days; you can revoke it sooner at any time. In the examples below the server is named flexim-{workspace}; you can use any name.
Some clients don't tell Flexim which workspace they are connecting to — Codex only does so when you pass --oauth-resource (see below). When the client stays silent, the consent page asks you to choose, and the connection is bound to the workspace you pick. If only one of your workspaces allows MCP, it is chosen automatically and nothing extra is asked.
Claude
Claude Code (CLI)
claude mcp add --transport http flexim-main https://flexim.io/api/v1/main/mcpThen run /mcp → select the connector → Authenticate.
Claude Desktop (claude.ai)
Open Settings → Connectors → Add custom connector, paste the endpoint URL, and authorize in the browser.
Codex
Codex CLI
For a Codex release that includes the OAuth issuer fix, connect directly to Flexim as a Streamable HTTP MCP server:
codex mcp add flexim-main --url https://flexim.io/api/v1/main/mcp --oauth-resource https://flexim.io/api/v1/main/mcpThis adds a Streamable HTTP MCP server. --oauth-resource tells Flexim which workspace the connection is for; it is available in recent Codex versions (0.144 and newer). Leave it out — or use an older Codex — and the consent page will ask you to pick the workspace instead.
If Codex marks the server as requiring OAuth but does not open the browser automatically, run:
codex mcp login flexim-mainAfter authorizing, restart Codex so it picks up the new tools.
Codex 0.146.0 compatibility
Use a persistent bridge only for the affected Codex version
Codex 0.146.0 can fail after browser authorization with Authorization server response missing required issuer. Flexim already sends the RFC 9207 iss parameter, but this Codex version drops it while processing the local OAuth callback. The failure is in the generic Codex MCP OAuth path, not in Flexim's refresh-token or discovery support.
Until you can update to a Codex release containing the upstream fix, add Flexim through mcp-remote:
codex mcp add flexim-main -- npx -y [email protected] https://flexim.io/api/v1/main/mcp --transport http-onlyThe one-line form works in POSIX shells, PowerShell, and cmd.exe. The package version is pinned so the copy-paste command does not silently change when a new community release is published.
The browser opens for the first authorization. Unlike a memory-only helper, mcp-remote saves the OAuth credentials under ~/.mcp-auth (or MCP_REMOTE_CONFIG_DIR), so closing and reopening Codex does not normally require another approval.
mcp-remote is a community, experimental bridge with file-backed credentials. It is a temporary compatibility workaround, not the long-term Flexim connection method. Built-in app connectors such as Linear and custom remote MCP servers use different Codex integration paths, so a working built-in connector does not rule out a bug in the generic MCP OAuth callback path.
To return to native OAuth after a fixed Codex release is available:
-
Remove the bridge definition with
codex mcp remove flexim-main. -
Add the direct Streamable HTTP server again:
codex mcp add flexim-main --url https://flexim.io/api/v1/main/mcp --oauth-resource https://flexim.io/api/v1/main/mcp -
Run
codex mcp login flexim-mainif Codex does not start authorization automatically. -
Verify the Flexim tools, then revoke the old bridge connection in Settings → MCP. Do not delete the whole
~/.mcp-authdirectory if other MCP servers use it.
References: Codex MCP documentation, the affected callback report, the upstream issuer-aware fix, and the mcp-remote README.
Codex Desktop
Open Settings → MCP Servers → Add server, switch the transport to Streamable HTTP, give it a name, and paste the endpoint URL.
Cursor
Add the server to ~/.cursor/mcp.json:
{
"mcpServers": {
"flexim-main": {
"url": "https://flexim.io/api/v1/main/mcp"
}
}
}Secure by design
Each connection is authorized through your Flexim account (OAuth) and its access token is scoped to the MCP endpoint only — it can't be reused against the rest of the API. What an assistant may do is governed by the MCP permission on the connecting member's role.
What the assistant can do
Once connected, the assistant has these tools available:
Explore your structure
- List content types — all collections and pages in the workspace, with field counts.
- Content type schema — the fields of a specific content type.
Read content
- List entries — records of a collection or page.
- Get an entry — a single record with all its fields (rich text is returned as Markdown).
- Search entries — find records by conditions.
Manage content
- Create an entry — add a new record.
- Update an entry — change specific fields of a record.
- Delete an entry — remove a record (moved to the trash when your plan enables it).
- Upload an image — add an image to a media field.
SEO topics
- List topics — compact summaries of the generated SEO topic suggestions, including their IDs and the same estimated
volumeand numerickdshown on the Topic Suggestions page. Missing estimates are returned asnull; in the UI, KD below 30 is Easy, 30–59 is Medium, and 60 or higher is Hard. - Get a topic prompt — the full Article Brief for one selected topic. The assistant lists compact summaries first, chooses a topic, and only then loads that topic's brief, so a large topic list is not truncated by repeated prompts.
- Update topic status — move a topic through its workflow.
Managing connections
Open Settings → MCP to see every AI client connected to the workspace. A client that requested background access renews its access token silently for up to 30 days, so it does not ask you to sign in every hour or every day. From here you can revoke any connection — the client immediately loses access and must be authorized again to reconnect.
If tools disappear after the token expires
Flexim reports an expired, malformed, wrong-workspace, or otherwise unverifiable access token with the standard OAuth invalid_token challenge while preserving workspace discovery metadata. An OAuth-capable client can use that signal to refresh the token or ask you to authorize again, but automatic refresh depends on the client. If it does not recover, reconnect Flexim from the client's MCP settings.