MCP - Curator by InterWorks Documentation

Introduction

Curator exposes a Model Context Protocol (MCP) endpoint. An MCP client such as Claude Code or Claude Desktop connects to it with a personal token and can then call a set of read-only and administrative tools. A token belongs to the backend user who generated it, and it can do nothing that user cannot do. Every tool call checks the owner’s backend permissions when it runs, and every call is recorded in the Usage Log with the owner’s login and the token’s prefix.

Generate a Token

Sign in to the backend and open the username dropdown at the top right.
Click MCP Tokens, then Generate Token.
Enter a Name that says where the token will be used, for example “Laptop Claude Code”.
Choose when the token Expires. The default is 90 days. Choose Never only for unattended service accounts.
Under Allowed tools, leave every tool checked, or clear the tools this token must not call. A token with every tool checked also gains tools added in later releases.
Click Generate.

The next page shows the full token once. Copy it now: Curator stores only a hash, so the token cannot be shown again. If you lose it, revoke it and generate a new one. The same page has a Connect a client panel with the endpoint URL and a ready-to-run Claude Code setup command. After you leave the page, the command shows <token> in place of the token.

Connect a Client

The endpoint is POST /curator/mcp on your Curator site, and the token travels as a bearer credential:

Authorization: Bearer cmcp_...

For Claude Code, run the setup command from the token page in a terminal. It has this form:

claude mcp add --transport http curator https://your-site.example.com/curator/mcp \
  --header "Authorization: Bearer cmcp_..."

Any client that speaks the MCP Streamable HTTP transport works the same way: point it at the endpoint URL and send the token in the Authorization header. The endpoint accepts JSON-RPC 2.0 over POST and answers with JSON. It does not open sessions or server-sent event streams.

Manage Tokens

MCP Tokens lists your tokens with their prefix, allowed tools, expiry, and last use. Open a token to edit its name or allowed tools; the owner, expiry, and token itself cannot change after generation. Tick one or more tokens and click Delete selected to revoke them. A revoked token stops working at once. You only see your own tokens. Tokens also stop working when their owner is banned, suspended, deleted, or past their password expiry.

Tools

Each tool runs with the owner’s permissions. A tool the owner cannot use is not offered to the client.

Tool	What it does	Permission
`get_status`	Curator build, PHP version, environment, and the configured drivers.	Same as the Status page
`get_info`	The full `/portal/info` report with secrets removed.	Same as the Status page
`clear_cache`	Clears every Curator cache, like the toolbar’s Clear Cache button.	Any backend user
`list_pages`	Lists Curator pages.	Any Content permission
`list_files`	Lists files.	Any Content permission
`list_keywords`	Lists content keywords.	Any Content permission
`list_menus`	Lists the navigation menu flat, with parent ids, link types, and URLs.	Any Content permission
`list_dashboards`	Lists Tableau dashboards.	Any Tableau permission
`list_powerbi_reports`	Lists Power BI reports.	Any Power BI permission
`list_powerbi_dashboards`	Lists Power BI dashboards.	Any Power BI permission
`list_thoughtspot_liveboards`	Lists ThoughtSpot liveboards.	Any ThoughtSpot permission
`list_sigma_workbooks`	Lists Sigma workbooks.	Any Sigma permission

“Same as the Status page” means any Portal permission: a user who holds any one Portal permission, such as managing URL redirects, can call get_status and get_info, exactly as they can open the Status page. get_info reports server, database, and hosting details, so review who holds a Portal permission before issuing tokens broadly. A list tool only appears when its plugin is installed. Every list tool takes the same optional arguments and returns the same shape: Arguments: search Text to match against the title, case-insensitive. Optional. limit The maximum number of items to return. Optional, defaults to 100, maximum 500. offset The number of items to skip, for paging. Optional, defaults to 0. Returns:

    {
        "total": 42,
        "offset": 0,
        "count": 2,
        "items": [
            {
                "id": 7,
                "title": "Sales Overview",
                "slug": "sales-overview",
                "url": "https://your-site.example.com/dashboard/sales-overview",
                "updated_at": "2026-09-01 14:02:11",
                "project_name": "Finance"
            }
        ]
    }

Some tools add a few columns of their own: pages include content_type, files include file_type and hidden, Tableau dashboards include project_name and featured, and Power BI items include group_name.

Limits and Logging

Requests are rate limited per client address using the same limits as the REST API, set under Settings > Security > Authentication Settings.
Every tool call writes a Usage Log row of type interworks.portal.mcp.call with the tool, its arguments, the owner, the token prefix, and the outcome.
Rejected sign-ins are written to the Curator log with the reason and the token prefix. The full token is never logged.

​Introduction

​Generate a Token

​Connect a Client

​Manage Tokens

​Tools

​Limits and Logging