Cora Universal Remote MCP Server & AI Integration

The Cora Universal MCP Server provides a single, standards-compliant remote endpoint (https://app.heycora.in/mcp) and OpenAPI 3.0.1 schema (/wp-json/cora-mcp/v1/openapi.json) allowing any Model Context Protocol (MCP) or OpenAI Custom Action client to securely interact with your workspace.

1. Universal Architecture

                      ANY MCP / LLM CLIENT
  (ChatGPT Actions • Claude Desktop • Gemini • Cursor • VS Code • Windsurf)
                             ↕
                  CORA REMOTE MCP ENDPOINTS
            JSON-RPC 2.0: https://app.heycora.in/mcp
            OpenAPI 3.0.1: https://app.heycora.in/wp-json/cora-mcp/v1/openapi.json
                             ↕
             OAUTH 2.1 & CONSENT PRESETS
          (RFC 6749, RFC 7636 PKCE, RFC 7591 Dynamic Registration)
                             ↕
                CORA WORKSPACE MULTI-TENANCY
              (Zero-Trust Server-Side Scoping)

• Production JSON-RPC Endpoint: https://app.heycora.in/mcp (or /wp-json/cora-mcp/v1/rpc)
• OpenAPI 3.0.1 Endpoint: https://app.heycora.in/wp-json/cora-mcp/v1/openapi.json (curated 28 tools ceiling; ?all=1 for full registry)
• OAuth Discovery: https://app.heycora.in/.well-known/oauth-authorization-server

2. OAuth 2.1 & Interactive Consent Panel (v4.9.345+)

Cora implements standard OAuth 2.1 with PKCE (S256) authorization code grant and an interactive granular consent panel:

1. Authorize Endpoint: https://app.heycora.in/oauth/authorize
2. Token Exchange Endpoint: https://app.heycora.in/oauth/token
3. Revocation Endpoint: https://app.heycora.in/oauth/revoke
4. User Info Endpoint: https://app.heycora.in/oauth/userinfo

Interactive Granular Consent Screen

When an external AI client requests permissions, the workspace owner reviews an interactive consent screen:

• Master Authorization Toggle: Instantly grant or revoke all requested permissions in a single tap.
• Category-Level Grouping: Scopes are neatly organized into logical categories (*Workspace & General*, *CRM & Deals*, *Projects & Tasks*, *Finance & GST*, *Content & Canvas*, *System & Config*).
• One-Tap Quick Presets:

- all: Selects all available read and write scopes.

- readonly: Enforces a strict read-only boundary across all modules.

- website: Grants access limited to Canvas themes and Content CMS.

• Cryptographic Binding: Issued access tokens are bound strictly to the authorized agency_id and automatically expire after 30 days.

3. ChatGPT Custom GPT Actions & OpenAPI 3.0.1 (v4.9.343+)

To ensure seamless, zero-error integration with OpenAI's Custom GPT Actions importer:

• OpenAPI 3.0.1 Specification: Upgraded from 3.1.0 to 3.0.1 to avoid undocumented OpenAI Custom GPT schema parser rejections.
• 28 Core Actions Ceiling: OpenAI enforces an undocumented limit of ~30 actions per Custom GPT. Cora caps default discovery at 28 prioritized operational tools. Developers requiring the complete unconstrained tool registry can pass ?all=1 or limit=all.
• Strict Schema Hardening:

- Zero emojis in operation summaries, tool names, and parameter descriptions.

- All input schemas declare explicit type: object with valid, non-empty properties objects.

- Empty required: [] arrays are omitted to satisfy OpenAI JSON schema validators.

4. Connecting AI Clients (ChatGPT, Claude, Cursor)

ChatGPT Custom GPT Action

1. In the GPT Builder, select Configure → Create new action.
2. Set Authentication: OAuth.
3. Set Client ID & Client Secret (from Cora Settings → AI Assistants).
4. Set Authorization URL: https://app.heycora.in/oauth/authorize
5. Set Token URL: https://app.heycora.in/oauth/token
6. Set Scope: workspace:read leads:read leads:write tasks:read tasks:write finance:read
7. Import Schema from URL: https://app.heycora.in/wp-json/cora-mcp/v1/openapi.json

Claude Desktop (`claude_desktop_config.json`)

{
  "mcpServers": {
    "cora": {
      "url": "https://app.heycora.in/mcp"
    }
  }
}

Cursor IDE

In Settings → Features → MCP, add a new server:

• Type: SSE / Remote
• URL: https://app.heycora.in/mcp

5. Curated 28 Core Tools Registry

Every Cora tool exposes explicit model-independent safety annotations:

6. Template Editor Live Action Playground (v4.9.344+)

The Canvas Template Editor includes a native AI Tools MCP Gateway & Live Action Playground:

• Interactive Three-Tier Testing:

- Natural Language Mode (`nl`): Plain-English prompts translated into validated MCP tool payloads.

- Guided Form Mode (`guided`): Form-based field inputs with dynamic validation and type checks.

- Developer Mode (`dev`): Raw JSON payload editing with syntax highlighting and schema validation.

• Live Tool Execution: Calls the MCP gateway against real workspace records and displays response JSON.
• 1-Click Code Reflection: Directly copies generated payloads or templates into the Template Editor code pane.

7. Multi-Tenant Security & Isolation

• Server-Side Enforcement: All operations are scoped by agency_id extracted from the cryptographically verified token.
• Audit Logging: Every AI tool execution is permanently logged in wp_cora_mcp_audit_log.
• Instant Revocation: Users can disconnect any AI assistant at any time from Settings → AI Assistants.