Connect your AI coding agent (MCP)

WamISSO runs a Model Context Protocol server. With it, an AI coding agent such as Claude Code, Cursor or VS Code Copilot can register your OAuth clients, read their settings and write the sign-in integration into your app, all from your editor.

Your agent signs in through WamISSO, just like an app: your browser opens WamISSO, you sign in (with MFA) and approve the agent. There are no tokens to create or copy, and you can disconnect an agent at any time under AI Agents (MCP) in the developer portal.

1. Add the server to your agent

Claude (claude.ai and the desktop app)

1. Open Settings → Connectors and choose Add custom connector.
2. Name it wamisso and use https://wamisso.rendovations.com/mcp as the URL (including /mcp).
3. Choose Connect. Claude opens WamISSO to sign in.

Claude Code

claude mcp add --transport http wamisso https://wamisso.rendovations.com/mcp

Then type /mcp in Claude Code and choose Authenticate.

Cursor (~/.cursor/mcp.json)

{
  "mcpServers": {
    "wamisso": { "url": "https://wamisso.rendovations.com/mcp" }
  }
}

VS Code (.vscode/mcp.json)

{
  "servers": {
    "wamisso": { "type": "http", "url": "https://wamisso.rendovations.com/mcp" }
  }
}

2. Sign in and approve

1. Sign in with your approved developer account and complete MFA.
2. Review the requested access: read your clients, and write (create and update) if your admin allows it.
3. Approve. The agent is connected and appears under AI Agents (MCP) in the portal.

3. Ask your agent

Examples:

• "Register a WamISSO testing client called Inventory Dev with callback http://localhost:3000/auth/callback, then add SSO login to this Laravel app."
• "List my WamISSO clients and check that this app's redirect URI matches."

For every create or update, the agent first shows you a preview. Nothing changes until you approve it.

4. Production: setting up a new app

Agents work with testing clients by default. If an administrator allows it, an agent can also create a new live (production) client, so the whole setup is automated before the app goes live.

1. An admin turns on Allow agents to create new live (production) clients in Admin → Settings.
2. Reconnect your agent (disconnect it under AI Agents (MCP), then connect again) and approve the "Create NEW live (production) OAuth clients" permission.
3. Ask, for example: "Create a live WamISSO client for Inventory with callback https://inventory.example.gov.ph/auth/wamisso/callback and put the credentials in the production .env."
4. Check the preview: it is marked LIVE. Approve only if the callback URL is exactly right.

Live callbacks must be public HTTPS URLs. Once a live client exists, an agent can read it but never change, delete or rotate it: real users sign in through it, so changes are made in the developer portal.

Available tools

Tool	What it does	Access
get-context	Your connection's permissions, limits and OAuth endpoints	Read
list-clients	Your clients in testing or live (never secrets)	Read
get-client	One client's settings	Read
get-integration-guide	Endpoints, environment variables and docs for a framework	Read
create-client	Register a testing client, or a new live client if allowed (preview, then confirm). MFA is always on.	Write
update-client	Change a testing client's name, redirect URIs or profile (preview, then confirm). Never live clients.	Write

Deleting clients, regenerating secrets, turning off MFA and uploading logos are only possible in the developer portal.

Guardrails

• Sign-in and approval: agents sign in through WamISSO with MFA, and only reach your own clients with the access you approved: testing, plus new live clients if you approved live access.
• Preview and approval: changes need a one-time confirmation code tied to the exact arguments. If any argument changes, the agent has to ask you again.
• Content checks: names, descriptions and URLs are rejected if they contain instructions aimed at AI, hidden or text-direction characters, HTML, secrets or keys, or names that impersonate WamISSO or well-known brands.
• Redirect protection: testing clients need local callbacks and live clients public HTTPS ones. Existing live clients can never be changed through MCP.
• Automatic suspension: three suspicious requests within an hour disconnect the agent.
• Rate limits: 60 calls per minute per connection, and 10 changes per hour per developer.
• Oversight: every call is logged. Admins can switch MCP off, restrict it to read-only or testing-only, and revoke any developer's access instantly.

Keeping secrets safe

• Prefer public clients (PKCE, no secret) for SPAs, mobile apps and CLIs. The agent creates public clients by default.
• A confidential client's secret is returned once. Make sure the agent writes it only to a git-ignored .env file.
• If something looks wrong, disconnect the agent in the portal, or regenerate the client secret.