Connect an agent. Use scoped tools.
Add https://mcp.specifywork.com/api/mcp to your app, sign in and allow access. Or choose Connect an agent in Specify for app-specific directions.
Plan the client connection
Connect over HTTP with OAuth and discover the tools your connection can use.
- Sign in and allow accessAdd the MCP address, sign in with OAuth, and choose the organization and what the app may do.
- Discover the actual toolsInitialize, inspect tools/list, and use the exact input schema for the work you intend to do.
- Record the sessionCreate a session, link its work and evidence, and handle decisions and retries explicitly.
Developer guides and reference
Search the API, MCP and agent setup guides and the MCP tool reference.
8 guides. Search also covers 127 MCP tool pages.
Connection guide
Add the MCP address, sign in with OAuth, allow access and verify the connection.
Identity, scopes and private records
Separate account membership, client scopes and record-level access.
MCP protocol reference
Initialize, discover tools, call a tool and interpret results.
The specify CLI
Sign a computer in to Specify Work, sync your skills and connect your agents from the terminal.
Pagination and retry safety
Continue bounded lists without mixing authorization sources or repeating mutations.
Quotes, jobs and credits
Distinguish a quote, a confirmed job, credits and a cash purchase.
Errors and recovery
Recover from invalid input, access changes and temporary service failures.
Security coverage and capture
Understand which traffic can be governed and what recorded evidence means.
Verify access before taking action
A client’s effective scopes come from the server. Requests retain explicit tool names and correlation IDs; writes add stable idempotency keys.
Open verify_access reference{
"jsonrpc": "2.0",
"id": "example_verify",
"method": "tools/call",
"params": {
"name": "verify_access",
"arguments": {}
}
}Know what the connection covers
- Private records stay scopedMembership, credentials and record grants are separate checks. Switching the public entry site cannot expand a client’s authority.
- MCP does not capture every commandAn MCP connection handles requests sent to that endpoint. Commands executed elsewhere in a client are outside that connection. Security adapters have separate coverage.