MCP

Atlar MCP server

The Atlar MCP server enables you to interact with the Atlar platform and your Atlar data via Claude and Claude Desktop .

What is MCP?

Model Context Protocol (MCP) is an open standard that allows AI applications and agents to securely access external data sources and tools. The Atlar MCP server provides AI agents with:

  • Direct API access to Atlar functionality
  • Documentation search capabilities
  • Real-time data from your Atlar account

How to set it up for the organization

  1. Update the security settings to allow authorizing Claude to use Atlar.

    This is a sensitive admin operation and you need organization:update permission to do so (often reserved to the Owner of the Atlar organization):

    In Atlar, navigate to Organization Security Settings (Settings → Security). Select desired access policy under Third-party OAuth client access policy (default is disabled, i.e. no access).

  2. Go to Claude and click "Customize"

  3. Click on "Add custom connector"

    (This step have to be performed by someone with admin permissions in your Anthropic/Claude enterprise account)

  4. Name the connection and add https://mcp.atlar.com/mcp to the remote sever URL then click Add.

  5. Now, users in Claude will be able to find the Atlar connector in their directory:


For each individual user connecting

  1. Search for Atlar in the connector directory

  2. Click Atlar MCP, then select Connect to authorize via OAuth.

  3. This will take you to the Atlar Dashboard. Here, you can allow Claude to only read data or also be able to create things in Atlar depending on your security posture. Clicking Allow will complete the OAuth authorization flow and redirect the user back to the Claude application.

    The agent inherits the exact same permissions as the authorizing user.

    (Note, if the Atlar organization level third-party OAuth client access policy was set to Disabled, the user will be denied permission to grant Claude access. If the organization level policy was set to Read-only, but the user selects Read and write at this step, the effective permissions granted will still only be read-only.)

  4. On the connector page, you will be able to adjust the settings of the connector as well as see what it can do and what data it has access to:




Verifying your MCP setup

Once configured, you can test your MCP server connection:

  1. Open your MCP client (e.g. Claude.ai or Claude Desktop)
  2. Start a new chat with the AI assistant
  3. Ask about Atlar — try questions like:
    • "What are my current balances across all accounts?"
    • "List my accounts"

The AI should now have access to your Atlar account data and documentation through the MCP server.

Consent management

If you want to revoke your granted consents you can list and manage your outstanding grants at https://app.atlar.com/profile.


Organization-level access policy

Before any user in your organization can connect an AI agent via MCP, an organization owner or admin must enable the third-party OAuth client access policy. The policy is disabled by default.

To configure it, go to Settings → Security and locate the Third-party OAuth client access policy section. There are three options:

SettingDescription
DisabledNo AI agents can access Atlar via the MCP connector. This is the default.
Read-onlyAI agents can read data from your Atlar account but cannot create, update, or delete resources.
Read and writeAI agents have full API access, scoped to the permissions of the authorizing user's role.

When enabled, any user in your organization can authorize an MCP client. The connected agent's access is limited by both the authorizing user's role and this policy. For example, if the policy is set to Read-only, an agent cannot perform write operations even if the authorizing user has a role that would normally allow them.

MCP and OAuth 2.1 security

The Atlar MCP server is in compliance with general MCP Authorization requirements as outlined in https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization . This means, non-exhaustively:

  • Support for OAuth 2.1 authorization_code grant flows with PKCE.
  • Support for OAuth Client ID Metadata Documents (CIMD). Allow-listed clients only, e.g. only official Claude.ai + Claude Code clients.
  • Access tokens for the MCP clients are constrained to mcp.atlar.com via audience claim. I.e. no direct access token passthrough to the Atlar REST API api.atlar.com.