MCP server

Lithic ships a first-party MCP server, so an agent — Claude, an agent CLI, anything that speaks the protocol — can read a workspace's documents and plans without anyone writing glue code.

There is nothing to install. The server runs on your Lithic instance and answers at https://app.lithicapp.io/mcp; you point an agent at that address and give it a token.

It is a thin layer over the public API: the endpoint holds no permission logic of its own but makes ordinary API requests with your credential, so an agent sees exactly what you see. Documents cross the wire as canonical Markdown.

It is read-only by choice: the server offers no writing tools, so there is nothing to configure to keep it that way. Editing a document belongs to the collaborative editor, where changes merge with everyone else's.

Setting it up

Mint a token first: Settings → Tokens, in the workspace the agent should read. content:read is all it needs. The secret is shown once.

A token minted here works here — it reads what Lithic shows you, and nothing the other apps hold. That also means you do not have to tell the agent which workspace to use: the token names one, and the endpoint reads it from there.

In an MCP host's configuration file:

{
  "mcpServers": {
    "lithic": {
      "type": "http",
      "url": "https://app.lithicapp.io/mcp",
      "headers": {
        "Authorization": "Bearer lithic_pat_…"
      }
    }
  }
}

Hosts differ in how they spell this; what they all need is the address and the Authorization header. In Claude Code, for example:

claude mcp add --transport http lithic https://app.lithicapp.io/mcp \
  --header "Authorization: Bearer lithic_pat_…"

If your account is in several workspaces and you want to name one explicitly, address https://app.lithicapp.io/mcp/w/<workspace id> instead. A token may only ever name its own workspace, so the two have to agree.

Adding it as a connector

Hosts that offer no header field — claude.ai among them — add the endpoint as a connector and sign you in instead. Paste the same address, https://app.lithicapp.io/mcp, into the connector dialog; the rest is a sign-in and one screen asking whether you want to connect. Nothing to copy, no token to keep.

A connector is broader than a token, and the screen says so before you agree:

• It covers every workspace you are a member of, not one.
• It reads what you can. Lithic offers no writing tools at all, so a connector cannot change anything here whatever it was granted.
• It still sees Lithic only, and it stops working when your access does.

Because a connector covers several workspaces, the agent has to say which one it means: https://app.lithicapp.io/mcp/w/<workspace id>.

What the agent gets

• get_workspace — name and shape of the workspace the token opens.
• list_outlines / get_outline — the documents, and one document as canonical Markdown.
• get_agenda — what is planned: the planned lines of a day or a week, timeboxes and untimed tasks alike.
• search — full-text over the workspace's documents.

What the agent cannot do, the token could not do either: permissions and visibility are the server's, not the MCP layer's.

When something is refused

The endpoint answers the way the API does, so a refusal says which of three things happened:

• 401 — no credential, or one that is unknown, revoked or expired.
• 403 — a credential that may not do this: a token without content:read, or one belonging to a different workspace than the address names.
• Everything else is the ordinary API's answer, passed through with the server's own wording.