MCP server
Filament Management includes a built-in MCP server, so an MCP client — Claude, or any other MCP-compatible tool — can read your inventory, or manage it, directly in conversation. There's nothing extra to install or host: turn it on in Settings, point your client at one URL, and sign in with your normal account.
Enabling it
Under Settings → MCP server (admin only):
- Enable MCP server — off by default. While off, the server rejects every request, including ones from clients that connected before it was disabled.
- Access mode — Read-only exposes list/get tools only. Read and write additionally exposes create/update/delete tools. Switching modes takes effect immediately for every already-connected client, not just new connections — there's no separate token to reissue or revoke, and no other way to grant write access short of this toggle.
The page also shows the server URL you'll give to your MCP client:
https://your-instance/api/v1/mcp
Everything else — where to authenticate, how to register as a client — is discovered automatically by the client from that one URL, per the MCP authorization spec.
Connecting from Claude
Claude.ai (web or desktop)
- Open Settings → Connectors in Claude.
- Choose Add custom connector.
- Paste your server URL (
https://your-instance/api/v1/mcp) and confirm. - Claude opens a browser window to your Filament Management instance. Log in if you're not already, then approve the consent screen — it names the connector and the access level it's requesting (matching whatever mode is currently set in Settings).
- Once approved, the connector shows as connected and its tools (
list_spools,create_spool, etc.) are available in chat.
Any other MCP client that supports a remote, OAuth-authenticated server over Streamable HTTP can connect the same way — point it at the same URL and follow its own login prompt.
What's actually happening
Filament Management acts as its own OAuth 2.1 authorization server for this: the client registers itself automatically (no manual client ID/secret to create), then redirects your browser through a normal login (or your workspace's SSO provider, if configured) followed by a one-time consent screen. The client never sees your password — it only ever receives a scoped access token after you explicitly approve it. Tokens expire after an hour and refresh automatically in the background for as long as the connector stays added; nothing needs re-approving unless you remove and re-add it.
Available tools
Every tool operates only on your own workspace's data — there's no way for a connected client to see or affect another tenant, regardless of what it's told.
Read-only (always available once enabled)
| Tool | Description |
|---|---|
list_spools | List spools, with optional filters by vendor, material, archive status, or free-text search |
get_spool | Get one spool by ID |
list_filaments | List filament types |
get_filament | Get one filament type by ID |
list_vendors | List vendors |
get_vendor | Get one vendor by ID |
list_storage_locations | List storage locations and their slot counts |
get_storage_location | Get a storage location with all of its slots and their occupying spools |
Read and write (only when Access mode is set to "Read and write")
| Tool | Description |
|---|---|
create_spool / update_spool / delete_spool | Manage spools |
create_filament / update_filament / delete_filament | Manage filament types |
create_vendor / update_vendor / delete_vendor | Manage vendors |
create_storage_location / update_storage_location / delete_storage_location | Manage storage locations |
If a client calls a write tool while the workspace is in read-only mode (or tries any tool while the server is disabled), it gets a clear error back instead of silently failing — this is checked on every single call, not just at connection time.
Revoking access
There's currently no per-client list to revoke individually. To cut off MCP access:
- Turn off "Enable MCP server" in Settings — every connected client, including ones with an active token, is rejected immediately.
- Switch to "Read-only" — keeps read access working but immediately removes write access from every connected client.
To remove a specific connector's own record of the connection, remove it from that client's side (e.g. Claude's Connectors settings) — it will simply be prompted to reconnect and re-approve if added back later.