Developers / MCP

Read check results from your AI client.

Connect one project with OAuth. Keep access scoped and revocable.

Beta · Client support not verified

What it is

A remote MCP server bound to your Koldera account through OAuth, not an API key. Access is read-only, scoped to exactly one project you pick during setup, and the client never sees or stores a Koldera secret key.

Read-only: it reads jobs and findings, nothing else.
One project per connection, chosen by you at consent time.
OAuth through your own sign-in - never a key pasted into the client.

Supported clients

Clients that support remote MCP servers with OAuth (Claude, Cursor) — beta, verified per client: compatibility is confirmed per client before we say it works; today: not yet verified.

Connect in five steps

Sign inUse your existing Koldera account.
Connect from the clientAdd Koldera as a remote MCP server in your AI assistant; it opens Koldera’s sign-in and consent screen.
Choose one projectPick exactly one project of one organization for this connection.
Approve read accessThe fixed, read-only permission set is all this connection can ever do.
Revoke any timeEnd the connection instantly from Connections, no need to go back to the client.

Server URL

MCP server URL

Add this address in your client’s remote MCP server settings.

What this connection can do

What this connection can and cannot do
Permission	Available in this beta
Read jobs and findings	Always on for the connected project.
Create checks	Not in this beta.

Out of scope

Create or run paid checks
Read file bytes or download links
Access other projects

Data shared with a client may be processed by its AI provider. Review that provider’s terms.

What the assistant sees

Job state, machine check status, rule ids and finding messages — never your files, never download links.

Data and privacy

Anything this connection reads through Koldera — job states, rule ids, finding messages — may be processed by the AI provider behind your client. Koldera sends nothing to any AI provider itself; the connection only answers what the client asks for, and only for the one project it is bound to.

Billing

This connection cannot start paid checks: it only reads jobs your project already ran through the API, SDKs or hosted tools.

What the assistant is told, and what it is not

A completed job means processing finished, not that the document passes anything. Every finding the assistant sees still needs a human’s manual review before anyone makes an accessibility claim.

What the machine check behind this actually isveraPDF's automated PDF/UA-1 result, not a WCAG decision

The machine check the assistant reads is veraPDF’s automated PDF/UA-1 result, which many real documents fail; it is not a WCAG conformance decision on its own.

Questions

Frequently asked questionsStopping the connection, changing project, why not an API key, the audit trail

How do I stop the connection?: Open Connections and revoke it any time; after you confirm, the client loses access immediately.
What happens if I want a different project?: Changing project: revoke the connection on the Connections page (this also withdraws the app’s authorization in your account), then connect again from the client.
Why not just use an API secret key?: Why not the API key: a secret key can create paid jobs and carries no per-client record of use. This connection is read-only, scoped to one project, and tied to your own sign-in, which a pasted key never is.
Where is the record of what this connection did?: On Connections: the client, its project, when it was created and when it was last used — the audit trail for every grant.

See the SDK documentation for a server or browser integration with write access instead.