# Set up the connector

**For IT administrators.** Adding the Junior connector to an AI client is a one-time job, usually done once for the workspace so it appears for everyone. Individual users don't need to do this — once it's added, they sign in with their own Junior account and go.

## Before you start

Your organization needs to be enabled for MCP access by the Junior team — there's no self-serve signup. Contact your Junior representative. They'll confirm your workspace identifier at the same time.

Enabling MCP grants nobody new visibility. Auth is per user, so each person still signs in as themselves and reaches only the projects and calls they can already open in the web app.

## Your connector URL

```
https://api.junior.ai/mcp/<your-workspace>
```

`<your-workspace>` is your organization's Junior subdomain — the same one in your workspace URL, e.g. `acme` for `acme.junior.ai`.

> If you don't know your workspace URL, visit `https://junior.ai/mcp/login` and enter your work email — it redirects to the right workspace.


## Setup by client

**Claude (web and desktop)** — Settings → Connectors → Add custom connector, paste the URL, then approve the Junior sign-in. Workspace admins can deploy a connector for the whole organization so users don't add it individually.

**Claude Code** — `claude mcp add --transport http junior https://api.junior.ai/mcp/<your-workspace>`, then run `/mcp` to complete authentication.

**Other MCP clients** — Junior implements streamable HTTP transport with OAuth 2.1 (dynamic client registration, PKCE, RFC 8707 resource indicators). Any spec-compliant client works; point it at the connector URL and let it discover the authorization server.

## Security model

Worth having to hand for a security review:

- **Per-user OAuth, no shared credential.** There is no API key to distribute or rotate. Each person authenticates as themselves.
- **Access mirrors the web app exactly.** A tool call returns only the projects, calls, and entities that user can already open in Junior. Deactivating their Junior account removes their access.
- **Read-only.** No tool can create, edit, or delete anything.
- **Tokens are workspace-bound.** Every access token is audience-bound to the exact connector URL it was issued for, so a token minted for one workspace cannot be replayed against another.
- **Revocable at the organization level.** Junior can suspend MCP access for your organization, which takes effect within one request rather than waiting for tokens to expire.


## Permissions

At sign-in each user approves these scopes:

| Scope | Grants |
|  --- | --- |
| `projects:read` | See the list and metadata of your projects |
| `calls:read` | Read your call records and summaries |
| `entities:read` | Read the entities (companies, products, etc.) recognized in your calls |


## Troubleshooting

**"MCP not enabled" during sign-in** — your organization hasn't been enabled yet. Contact your Junior representative.

**Sign-in succeeds but no tools appear** — the client is caching an old tool list. Disconnect and reconnect the connector; Junior versions its tool surface so clients can detect changes.

**A user can't see a call they can see in Junior** — most tools default to that person's own calls and projects. The assistant needs to ask with a broader scope to include calls shared by teammates. This is a scoping default, not a permissions problem.