> ## Documentation Index > Fetch the complete documentation index at: https://docs.prophia.com/llms.txt > Use this file to discover all available pages before exploring further. # MCP Server Overview > What the Prophia MCP server is, what a connected assistant can do, and what it can't Prophia operates a **hosted, remote MCP server** that exposes your portfolio — accounts, properties, buildings, spaces, leases, documents, and the terms extracted from them — as tools an AI assistant can call. There is nothing to install or run on your side. **You bring your own AI.** Prophia provides the data connection, not the model or the chat interface. Any client that speaks the MCP **Streamable HTTP** transport works. > [!NOTE] > > This is the server that reaches **your portfolio data**. The documentation site runs a separate, public MCP server that lets an assistant search **these pages** — see [Connect AI to these docs](https://docs.prophia.com/developers/docs-mcp.md). > [card] [Set up OAuth](https://docs.prophia.com/developers/mcp/oauth-setup.md) > > One-time, org-wide. An admin connects your identity provider so everyone signs in with corporate credentials. > [card] [Connect a client](https://docs.prophia.com/developers/mcp/connect-claude.md) > > Claude, Cursor, or anything else that speaks Streamable HTTP. ## Two ways to connect | | OAuth | API key | | - | - | - | | **Users sign in with** | Your corporate SSO | A shared secret string | | **Users choose what the client can access** | Yes, on accounts that use [role-based permissions](#choosing-what-a-connection-can-access), whichever client connects | No — the key's own access applies | | **One-time admin setup** | Yes — an admin at your organization [registers your identity provider](https://docs.prophia.com/developers/mcp/oauth-setup.md) in Prophia | Yes — an admin [generates the key](https://docs.prophia.com/developers/mcp/api-key-access.md) | | **Works with Claude Desktop** | **Yes** | **No** | | **Works with Microsoft Copilot Studio** | **No** | **Yes** | | **Works with Claude Code, Cursor, other clients** | Yes | Yes | | **Best for** | Most organizations, especially with multiple users | Single-user or scripted setups where the client can't do OAuth | With OAuth, users sign in with credentials they already have, and there is no long-lived secret to distribute or rotate. If your goal is to connect Claude Desktop, you must use OAuth; if it is Copilot Studio, you must use an API key. ## What your assistant can do Ask questions in natural language and the assistant picks the tools. In practice that covers four things: | | For example | | - | - | | **Navigate the portfolio** | "Which buildings are in Bayside Corporate Center, and what's the stacking plan?" | | **Read lease terms** | "When does the Initech lease expire, and what are the renewal options?" | | **Search document text** | "Find the assignment clause in the Initech lease and quote it, with the page it's on." | | **Query analytics** | "What's my occupied square footage by property?" | Every answer traces back to a source document — tools return the page and the position on it, so the assistant can cite rather than paraphrase. ## What it cannot do The MCP server is **read-only, with two exceptions**: your assistant can manage [custom terms](https://docs.prophia.com/api-reference/v2/concepts/tags-and-values.md) and save portfolio reports. Everything else is read-only. If you need to write portfolio data programmatically, that's the [REST API](https://docs.prophia.com/api-reference/v2/introduction.md), which has its own [write access](https://docs.prophia.com/developers/write-access.md) entitlement. ## Permissions Your Prophia permissions apply to every tool call. The same [capabilities model](https://docs.prophia.com/api-reference/v2/concepts/errors-and-permissions.md#the-capabilities-model) that governs the REST API governs MCP: * **Connecting over OAuth** gives the assistant at most what *you* can see. Building-level permissions filter the results, so two people at the same company can ask the same question and get different answers. On accounts that use role-based permissions, every OAuth connection is further limited to what you [allow when you connect](#choosing-what-a-connection-can-access), whichever client you use. * **Connecting with an account API key** gives the assistant admin-level access to the whole account, whoever is typing. * Tools appear in the list whether or not you can use them. A tool you lack the capability for fails at call time with a message naming what's missing — it isn't hidden from the list. ### Choosing what a connection can access On accounts that use role-based permissions, every OAuth connection goes through a consent screen after you sign in. The client makes no difference: Claude Desktop, Claude Code, Cursor and every other MCP client get the same screen. It names the client and the Prophia account, and lists what the connection may read and, for custom terms and portfolio reports, change. * **Everything you can access starts selected.** Uncheck anything you don't want the client to use. A capability you don't hold is greyed out: a connection can't do more than you can. * **Allow Access** requires at least one capability. Every tool call on the connection is then limited to what you allowed, on top of your own permissions. Account admins are limited the same way. * **Cancel** stops the connection, and your client reports that access was denied. Each connection gets its own choice, and Prophia doesn't remember it for the next one. A client that registered with a client secret refreshes its access token without signing in again and keeps the choice until the connection reaches your account's [maximum connection lifetime](https://docs.prophia.com/developers/mcp/oauth-setup.md#how-long-a-connection-lasts). A client that registered without one signs in again when its 12-hour access token expires, and the consent screen appears again. To change what a client can access before then, disconnect and reconnect it. On accounts that don't use role-based permissions there is no consent screen, and the connection gets everything you can see. [API key](https://docs.prophia.com/developers/mcp/api-key-access.md) connections never show it. ## Built-in guides The server publishes its own documentation as MCP **resources** — `guide://` documents your assistant reads on demand to use the tools well. Assistants discover them with `list_guides` and fetch them with `read_guides`, usually without being asked. | Guide | Covers | | - | - | | `guide://navigation/conventions` | Id formats, naming, and how the hierarchy fits together | | `guide://navigation/patterns` | Getting from a tenant name to the right lease efficiently | | `guide://navigation/tools` | Which navigation tool to reach for | | `guide://smart-search/strategies` | Phrasing document searches that actually hit | | `guide://stacking-plan/reading` | Interpreting stacking plan output | | `guide://portfolio-analytics/querying` | Composing analytics queries without inflating aggregates | | `guide://save-portfolio-report/filters` | Filter syntax for saved reports | | `guide://schema/index` | Result schema for each tool | This is why the server tends to work well without prompt engineering on your side: the instructions travel with the tools. ## Next steps > [card] [OAuth setup](https://docs.prophia.com/developers/mcp/oauth-setup.md) > > For the admin doing the one-time identity-provider configuration. > [card] [Connect Claude](https://docs.prophia.com/developers/mcp/connect-claude.md) > > Claude Desktop and Claude Code. > [card] [Other clients](https://docs.prophia.com/developers/mcp/connect-other-clients.md) > > Cursor and any Streamable-HTTP client. > [card] [Tools reference](https://docs.prophia.com/developers/mcp/tools-reference.md) > > Every tool the server exposes. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.