Connecting a tool

Every workspace answers on its own address: https://<workspace>.kaiku.tech, where <workspace> is the name your company chose when it signed up. The same address serves the app you open in a browser, the tracker API, the wiki API and the MCP server — a tool is always given this one address and nothing else.

Give a tool the bare address, without a path. It adds /rest/api/2, /rest/agile/1.0 or /rest/api/content itself, the way it does for the tracker it was written for.

An address that no workspace answers on gets a 404 saying so — never somebody else’s workspace. If you see it, check the name in front of .kaiku.tech.

A tool signs in with a personal access token. The token acts as you: it sees exactly what you see and may change exactly what you may change.

1. Open Settings from your account menu and choose the Connect over MCP tab. It is there for every user, whatever the tab’s name suggests: the token it makes works for the tracker and wiki APIs too.
2. Under 1. Generate a token, give the token a name you will recognise later (for example «Laptop CLI»).
3. In Scope, keep All projects, or pick one project to limit the token to it.
4. Press Generate token. If your account has a second factor, you are asked for a code.
5. Copy the token at once. It is shown only this one time; we keep only a fingerprint of it and cannot show it again.

Your tokens are listed below, under Your tokens, with their scope and when each was last used. Open a row to switch it to Read-only or to change its scope, or to Revoke it — a revoked token stops working immediately. Lost a device? Sign out everywhere else revokes every token and session except the one you are using.

• A token does not expire. It works until you revoke it.
• A token works only at the address of the workspace it was made in.
• A read-only token may read anything its scope allows, and may run searches. Anything that would change something is refused with a 403.

Two forms are accepted, and both land on the same account:

Basic with your real password also works, but not for an account with a second factor, and not while an administrator-set temporary password is still unchanged. Use a token.

The email in a Basic header is compared exactly as it is written in your account, capital letters included.