MCP: Connect an AI Client

ContentStudio’s primary remote MCP endpoint is:

• https://mcp.contentstudio.io/v1/mcp — the canonical endpoint for ContentStudio MCP client integrations.

A separate /mcp surface may exist, but it is not the default integration endpoint and is outside the scope of this guide until its intended audience and contract are independently verified.

Use /v1/mcp when configuring a ContentStudio MCP client.

Authentication

The primary /v1/mcp endpoint is designed for OAuth or a ContentStudio API key supplied in a request header. Its OAuth protected-resource metadata identifies https://api.contentstudio.io as the authorization server and exposes contentstudio:read and contentstudio:write scopes.

Use OAuth where the client supports it. Never place an API key in source control, logs, or shared configuration.

Connect with OAuth

Add the primary endpoint in your MCP client’s custom connector or remote-server settings:

https://mcp.contentstudio.io/v1/mcp

Complete the authorization flow in the browser window opened by the client.

API-key fallback

Use an API key only when an approved client cannot complete OAuth, and store it in that client’s protected configuration. The MCP implementation design permits header-based API-key authentication; URL-only query-key support and client-specific setup must be verified against the deployed service before public publication.

Safe first interaction

After connection, begin with a read-only request such as listing ContentStudio workspaces or connected accounts. Confirm the workspace before permitting any create, schedule, approve, update, or delete action.

Key lifecycle and security

• Prefer OAuth for supported clients.

• Regenerating a key requires updating every integration that depends on it.

• Use distinct keys or access configurations for separate environments when supported by your operating model.

• Review and remove unused client configurations.

• Restrict write-capable integrations to authorized users and systems.

Validation status

The primary endpoint and the repository’s OAuth design confirm /v1/mcp, OAuth discovery, and read/write scopes. A deployed-service test is still required to validate client-specific configuration, tool inventory, permissions, query-key behavior, and compatibility before this article is published.

Draft status: this article now uses /v1/mcp as the canonical endpoint. Do not publish until the deployed endpoint and supported clients are tested.