Connecting a client

Every client connects to the same address:

https://editory.news/api/mcp

What differs is how you prove who you are. There are two ways, and which one you need is decided by your client, not by you.

Which one do you need?

Your client	Use	Why
claude.ai (web)	Sign in	No field to put a header in
Claude Desktop	Sign in	Same
ChatGPT	Sign in	Same
Claude Code	Either	Sign-in is fewer steps; a token is better for a shared machine or CI
Codex	Token	Reads a bearer token from an environment variable
Your own code	Token	Simplest thing that works

The rule underneath: if the client gives you a box for a URL and nothing else, you sign in. If it gives you somewhere to put a header, you can use a token. Both end up as the same user with the same tools. Nothing is available one way and not the other.

---

Signing in

Nothing to create beforehand and nothing to paste. Your client registers itself with Editory automatically, sends you to a browser to approve it, and stores the result.

1. Add a custom connector

   claude.ai

   Settings → Connectors → Add custom connector, then paste:

   https://editory.news/api/mcp

   Claude Desktop

   Settings → Connectors → Add custom connector, then paste:

   https://editory.news/api/mcp

   Desktop and claude.ai share connectors: adding it in one shows it in the other.

   ChatGPT

   Custom MCP connectors live under Settings → Connectors. Add:

   https://editory.news/api/mcp

   Sign-in is the same browser flow as everywhere else. There is nothing to register and no key to paste.

   How much you get depends on developer mode. Without it, ChatGPT restricts a custom connector to two tools, so Editory gives you search and fetch: find your scripts and videos by keyword, read them, quote them, link to them. To make something (write a script, cut a video, edit one), turn on developer mode under Settings → Security and login, which lifts the restriction and exposes the full tool surface.

   Note

   Which accounts may add custom connectors, and what they may do once added, is OpenAI’s policy and it moves. If the option isn’t there, that’s a ChatGPT-side limit rather than something to fix here. Use Claude Code or your own client with a token instead.

   Claude Code

   Add it with no header, then authenticate:

   claude mcp add --transport http editory https://editory.news/api/mcp

   Run /mcp inside Claude Code and pick editory to open the browser flow. Claude Code stores the result and refreshes it for you.

2. Approve it

   A browser opens on Editory’s consent screen. Read it before approving: this is the step that hands something access to your account.

   Check the redirect URI. It’s shown in full, monospaced, and it is the one field on that screen a client cannot fake: everything else, including the name, is chosen by whoever registered. If you’re connecting Claude and the redirect points somewhere that isn’t Anthropic, stop.

   Approving grants the whole toolset

   The permissions listed (confirm who you are, see your email, see your profile) describe what the client learns about you. They do not limit what it can then do. An approved client can use every tool on this server: write scripts, cut videos, edit manifests, spend your generation quota.

   That’s a property of the protocol, not a gap in this screen. Approve connectors you actually recognise.

3. Ask for something

   Read https://example.com/article and write me a 60-second script in a conversational tone.

   If the tools don’t show up, see Troubleshooting.

Disconnecting

Remove the connector in the client that added it. That’s what ends the connection today. Editory doesn’t yet list your approved connectors anywhere in the app, so there is no second place to check.

Tip

If a machine has left your hands and you want certainty rather than a client-side removal, connect that machine with a token instead. Tokens are listed under Settings → API Access and revoke instantly, from your side, without needing the client to cooperate.

---

Using a token

For clients that take a header, and for anywhere you’d rather not depend on a browser round trip.

1. Mint a personal access token

   In Editory, go to Settings → API Access and create a key. Name it after the client you’re connecting, so you know which one to revoke later.

   The token is shown once, at creation. It starts with edty_. Copy it now: Editory stores only a hash and cannot show it to you again.

   A token is your whole account

   A personal access token authenticates as you, with no narrower scope. Treat it like a password: keep it out of shared configs and commits, and revoke it from the same page the moment a machine it lived on leaves your hands.

2. Give it to your client

   Claude Code

   claude mcp add --transport http editory https://editory.news/api/mcp \
     --header "Authorization: Bearer edty_your_token_here"

   Codex

   export EDITORY_TOKEN=edty_your_token_here
   codex mcp add editory \
     --url https://editory.news/api/mcp \
     --bearer-token-env-var EDITORY_TOKEN

   Codex reads the token from the environment at run time, so the config file holds the variable’s name and never the secret.

   mcp-remote

   For a client that only speaks stdio, bridge it:

   {
     "mcpServers": {
       "editory": {
         "command": "npx",
         "args": [
           "mcp-remote",
           "https://editory.news/api/mcp",
           "--header",
           "Authorization: Bearer edty_your_token_here"
         ]
       }
     }
   }

   Your own client

   Streamable HTTP, stateless, POST only. No session negotiation, no initialize handshake to keep alive, no SSE stream to hold open. Each request stands alone.

   curl -X POST https://editory.news/api/mcp \
     -H "Authorization: Bearer edty_your_token_here" \
     -H "Content-Type: application/json" \
     -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

---

Checking it worked

Ask your client to list what it can do. Every MCP client has some form of this, and the tool reference is what you should see. Or from a terminal:

curl -sX POST https://editory.news/api/mcp \
  -H "Authorization: Bearer edty_your_token_here" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

A connection with no credential is refused the same way regardless of client:

curl -isX POST https://editory.news/api/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | head -2

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://editory.news/.well-known/oauth-protected-resource/api/mcp", …

That header is the whole sign-in flow in one line: a client with no credential reads it, follows the pointer to find out who issues tokens for this server, and starts the browser flow on its own. Nothing about it needs configuring.

Troubleshooting

What you see	What it means
401, or the client keeps asking you to sign in	The token is wrong, revoked, or was never sent. Check for a stray space or a truncated paste. A valid token is edty_ plus 43 characters.
405 Method not allowed	Something sent a GET. This server is POST-only; there is no event stream to open.
Connector added, no tools listed	The client added the URL but never completed sign-in. Look for a Connect or Authenticate action on the connector itself.
Sign-in loops back to the consent screen	Third-party cookies are blocked, or the browser finishing the flow isn’t signed in to Editory. Sign in to editory.news first, then retry.
A tool answers with an error card instead of failing	Working as intended: read it. Errors carry the valid options, so naming a brand kit that doesn’t exist tells you the ones that do.

Which host to use

https://editory.news/api/mcp is production, and it is the one you want.

https://dev.editory.news/api/mcp runs the same code against the staging environment and serves its own discovery document, so a client connects there the same way. It holds different data and gets deployed to more often. Use it if you’re testing something you don’t want in your real account.