MCP server
Trotto offers a hosted MCP (Model Context Protocol) server so an AI agent — claude.ai, Claude Code, Claude Desktop, ChatGPT, or your own agent stack — can search and create your organization's go links. It is the agent-native front end to the same links API described on the API access page.
To get started, email help@trot.to. We'll enable your organization, provide your MCP endpoint, and send setup instructions for your client.
Authentication
There are two ways to authenticate, and both work at the same endpoint:
- Sign in with your work account — best for people using an AI client interactively. There's nothing to copy or configure; you sign in through your organization's existing Trotto login.
- API key — best for automation and service accounts (scripts, bots, integrations), where no person is present to sign in.
Signing in with your work account
Add the Trotto MCP server to your client with no key or header at all. The first time the agent connects, your browser opens your organization's usual Trotto sign-in — Okta or Google — followed by a consent screen showing exactly what the agent will be able to do:
- Search go links — always granted.
- Create go links — granted only if you approve it. Links the agent creates are owned by you, just as if you'd created them in the Trotto UI.
A few things to know:
- Your organization must be enabled for MCP access first — email help@trot.to to turn it on. Once enabled, anyone in your organization can connect; there's no per-user setup.
- Sessions are short-lived (about an hour); your client will prompt you to sign in again when needed.
- Sign-in via Okta (and other SAML identity providers) and Google is supported today. Microsoft 365 sign-in is not yet supported — use an API key in the meantime.
- Desktop and command-line clients (such as Claude Code) work out of the box. Web-based clients are supported for claude.ai and ChatGPT; if your client signs in from another domain, let us know and we'll enable it.
Using an API key
The MCP server accepts the same API keys as the REST API. Your key is sent in the Authorization header (a Bearer prefix is also accepted). What the agent can do depends on the key's scope:
- A read-only API key can use the
search_linkstool;create_linkis refused with a clear message. - A create API key can use both
search_linksandcreate_link; new links are owned by the key's user.
See the API access page for the full list of key kinds. Treat any key like a password — keep it secret, and let us know if it is ever exposed so we can revoke it. Signing in doesn't replace API keys: a key is still the right choice whenever there's no human in the loop.
Tools
search_links
Search your organization's go links.
| Argument | Description |
|---|---|
query | Optional. Fuzzy-match shortpaths, best matches first (for example, roadmap). |
destination | Optional. Return links whose destination URL is an exact match. |
page | Optional, default 1. Results are paginated, 20 per page. |
Pass no arguments to list all links. Each result includes the shortpath, destination URL, owner, namespace, and visit count, along with page, total, and total_pages so an agent can page through everything.
create_link
Create a new go link. Requires a create (or admin) API key, or a sign-in where you approved Create go links.
| Argument | Description |
|---|---|
shortpath | Required. The go link path, for example roadmap. |
destination | Required. The full destination URL. |
namespace | Optional. Defaults to your organization's default namespace (usually go). |
unlisted | Optional, default false. If true, the link is hidden from other members' searches. |
Returns the created link. Attempting to create a shortpath that already exists returns a clear error.
Connecting your client
The server speaks MCP over Streamable HTTP, so any MCP-capable client works, and there is nothing to install beyond your client:
- Interactive clients (claude.ai, Claude Code, Claude Desktop, ChatGPT): point the client at your Trotto MCP endpoint with no credentials — it walks you through signing in with your work account on first use.
- Headless clients (the Claude API, scripts, agents running unattended): point the client at the endpoint and set the
Authorizationheader with your API key.
Email help@trot.to and we'll send you your endpoint and step-by-step setup for your client.
Limits
- Requests are rate limited to 50 per hour per API key or per sign-in, shared across both tools.
- Errors come back as clear tool errors an agent can act on: a missing, invalid, or revoked key; an expired sign-in (your client will prompt you to sign in again); the hourly rate limit being exceeded; or an attempt to create a link without create access.