# Approve MCP

Remote endpoint: https://mcp.approve.so/mcp
Transport: Streamable HTTP
Connection guide: https://approve.so/docs/mcp

## Agent connection workflow

1. When a user asks you to use Approve, reuse an authenticated MCP connection if one is available.
2. If the server is not configured, add the endpoint below as a remote Streamable HTTP MCP server in your client.
3. On HTTP 401, let your client refresh its saved session. If login is still required, start the client's OAuth login flow and open the authorization URL it generates. A 401 means authentication is required; it is not evidence that the service is broken.
4. Keep the login process running while the user signs in on approve.so, selects workspaces and permissions, and confirms with their Approve password. If you cannot open a browser, show the generated URL to the user. Never ask them to paste passwords or tokens into chat.
5. Wait for the client to confirm login, then call approve_workspace_list and resume the user's original task. A consent-page click or a healthy server alone does not verify access.
6. If the request expired, was already used, or the callback listener stopped, start one fresh client login. Do not reuse old consent URLs or repeatedly restart a login that is still waiting for the user.
7. For HTTP 403 or a missing tool, check the selected workspaces, granted scopes, and the user's permissions. Reconnect only if a different selection is needed; repeated login does not grant missing account permissions.

## Codex

Add once: codex mcp add approve --url https://mcp.approve.so/mcp
Login when required: codex mcp login approve
Read-only login: codex mcp login approve --scopes approve:read

Let the client discover the OAuth resource. Do not add a duplicate --oauth-resource override. Do not construct /authorize URLs or open a standalone /login page: the client must retain its PKCE verifier, state, and callback listener.

## Discovery

Protected resource: https://mcp.approve.so/.well-known/oauth-protected-resource/mcp
Authorization server: https://mcp.approve.so/.well-known/oauth-authorization-server

After consent, use Continue to your agent if automatic navigation pauses. Keep the client running until it confirms success. Manage and revoke connections at https://approve.so/account.