MCP Server

Sayr runs a remote Model Context Protocol (MCP) server, so an AI agent can read and write tasks, comments, and more in your organization on your behalf, the same way the CLI or a personal access token does.

Setting it up

The server URL is:

https://api.sayr.io/mcp

Sayr's MCP server authenticates over OAuth, the same standard most modern MCP clients speak natively. Adding the URL is normally the whole setup: your client discovers the authorization server on its own, opens a browser for you to sign in, and shows a consent screen listing exactly which scopes the agent is requesting before anything connects. No API key to generate or paste in.

Where you paste the URL and what the menu is called varies by client. A few common ones:

Claude Code

claude mcp add --transport http sayr https://api.sayr.io/mcp

Then start a session and run /mcp to finish signing in.

Claude.ai / Claude Desktop

Configured in the app, not a file: Settings → Connectors → Add custom connector, then enter a name and the URL above. (Requires a paid Claude plan.)

ChatGPT

Also UI-only: Settings → Connectors → Advanced settings → Developer mode (turn it on) → Create connector, then enter a name, the URL, and set Authentication to OAuth. (Requires a ChatGPT Plus, Pro, Team, or Enterprise account.)

Cursor

.cursor/mcp.json in your project, or ~/.cursor/mcp.json globally:

{
	"mcpServers": {
		"sayr": { "url": "https://api.sayr.io/mcp" }
	}
}

VS Code (GitHub Copilot)

.vscode/mcp.json — note the top-level key is servers, not mcpServers, and type is required here:

{
	"servers": {
		"sayr": { "type": "http", "url": "https://api.sayr.io/mcp" }
	}
}

Other JSON-config clients

Most other clients follow Cursor's shape, a mcpServers object keyed by a name you choose:

{
	"mcpServers": {
		"sayr": { "url": "https://api.sayr.io/mcp" }
	}
}

A few (Windsurf, for one) use serverUrl instead of url — check your client's own docs if the connection doesn't show up after a restart.

YAML-based configs

If your tool or agent framework takes its MCP server list as YAML rather than JSON, the equivalent is usually:

mcpServers:
  sayr:
    url: https://api.sayr.io/mcp

Local-only (stdio) clients

If your client only supports local command-based servers, bridge it with mcp-remote:

{
	"mcpServers": {
		"sayr": { "command": "npx", "args": ["-y", "mcp-remote", "https://api.sayr.io/mcp"] }
	}
}

Whichever client you use, the first connection opens a browser for you to sign in and approve the requested scopes — nothing to generate or copy in beforehand.

What it can do today

Account

Tasks

Comments

Releases

To add a task to a release, use update_task with the release's slug or id as releaseId.

Release activity

Organization reference

Every tool except whoami and list_organizations takes an org argument (an organization's slug or id), so one connection can act across every organization you belong to — the agent names which org each call targets. Descriptions and comments are written and returned as Markdown.

Permissions

MCP access reuses the exact same scope vocabulary and permission model as personal access tokens: during consent, you approve a specific set of scopes (tasks.read, tasks.create, tasks.comment, and so on), and from then on every call is checked twice — does the connection hold the scope, and do your teams in that organization currently allow it. A connection can never do more than you can yourself: if your team can't edit other people's tasks or manage labels, neither can your agent, even with every scope approved. Member, team, and billing management are never reachable this way, whatever scopes were granted.

Like the CLI, the MCP server applies these checks to every task — including ones you created or are assigned to. If your team doesn't grant tasks.editAny, an agent can still change status and priority (where allowed) but not a task's title or description.

If your role or teams change, that takes effect on the very next call — nothing is cached against the old permissions.

Disconnecting an app

Every app you've approved is listed under Settings → Connections → Connected apps, with when you connected it and how many permissions it holds. Revoke cuts it off immediately: its current access stops working on the next call, and it can't renew it. To use the app again, connect it and approve it from scratch.

Rate limits

Usage is rate-limited per organization, not capped by a monthly quota — there's no "ran out of AI actions" wall. The limit is higher on Pro:

The limit follows the plan of the organization each call targets, and every person and organization is metered independently: hitting the limit against one organization doesn't affect calls against another, and a teammate's agent doesn't use up yours.

Related

• CLI: the same /v1/me/* API, from your terminal
• Authentication & API keys: the scope catalog and how the permission check works
• Public API & SDK