Which AI clients can connect to Lucidity's MCP server?

Any MCP-compatible client, such as ChatGPT or Claude, after an administrator pre-registers it with an exact HTTPS callback allowlist. Public clients authenticate with no client secret; confidential clients use client_secret_basic or client_secret_post, and Lucidity stores only SHA-256 hashes of secrets.

How does MCP access differ from a Lucidity API access token?

API access tokens are revocable credentials for programmatic integrations and are never accepted by the MCP server. MCP access is per-user, per-session authorization through OAuth 2.1 with PKCE, and business scope is resolved from the connected user's current membership rows on every call, so access changes take effect immediately.

Lead Routing and Analytics with an MCP Connection

Q: Does Lucidity have an MCP server?

Yes. Lucidity exposes a read-only Model Context Protocol server at its /mcp endpoint. It implements the 2026-07-28 revision with stateless requests and accepts stateless 2025-era Streamable HTTP requests while AI clients migrate. Tools cover businesses, analytics, lead search, single leads with attribution and deliveries, and read-only search and fetch.

Q: Can the MCP server change or delete my data?

No. Every tool is marked read-only, non-destructive, and idempotent, and the server is closed-world: only the listed tools exist. The MCP server also never accepts Lucidity API access tokens or browser cookies; it requires its own OAuth 2.1 authorization code grant with S256 PKCE.

What an MCP connection is

The Model Context Protocol is the standard way AI assistants connect to external tools and data. Instead of exporting CSVs into a chat window or building a custom integration, an MCP-compatible client such as ChatGPT or Claude connects once to a server that exposes a defined set of tools, and the assistant can then answer questions by calling them.

For lead software this matters because the questions operations teams ask are about records that live in a database, not in a document: which leads failed delivery, what changed week over week, which business saw a spike. An MCP connection lets the AI client answer from the live system, read-only, through the same scope rules the dashboard enforces.

Short answer: Lucidity runs a read-only MCP server at its /mcp endpoint with its own OAuth 2.1 authorization. It never accepts Lucidity API tokens or browser cookies, every tool is non-destructive and idempotent, and business scope is resolved from the connected user's memberships on every call. If you are evaluating lead software by AI readiness, that is the checklist to verify with each vendor.

What the Lucidity MCP server exposes

Tool	What it returns
`list_businesses`	The Businesses accessible to the connected user.
`get_analytics`	The canonical analytics report used by the dashboard, with optional recommendations and GA4 connection health.
`list_leads`	Bounded lead search filtered by business, status, source, campaign, query text, limit, and cursor.
`get_lead`	One scoped Lead with its attribution, validation evidence, outcome, and deliveries.
`search` and `fetch`	Read-only company-knowledge shapes for AI search and research compatibility.

The server implements the MCP revision dated 2026-07-28: stateless, self-contained requests, server discovery, per-request metadata, required HTTP header validation, result type discriminators, and cache metadata. It also accepts stateless 2025-era Streamable HTTP requests while AI clients finish migrating to the new revision.

What you can ask once connected

"Show me failed leads for this client business." list_leads with a business and status filter, then get_lead to inspect the delivery records and reasons. A lead's status is not a complete count of failed delivery attempts.
"Summarize this month's lead quality for the HVAC group." get_analytics for the canonical report, with GA4 connection health visible if traffic context is configured.
"Show me every lead from the paid search campaign still sitting in review." list_leads with source and status filters, with validation evidence per lead on request.
"What do we know about the lead from last Tuesday that never reached HubSpot?" get_lead for attribution, validation outcome, and every delivery attempt with its result.

The security model, in full

Control	How Lucidity implements it
Authorization	Its own OAuth 2.1 authorization code grant with S256 PKCE. The MCP server never accepts Lucidity API access tokens or browser cookies.
Client registration	Pre-registered clients with an exact HTTPS callback allowlist, up to 50 clients and 20 redirects each. No dynamic client registration, which avoids an outbound metadata-fetch SSRF surface.
Client authentication	Public clients use no client secret; confidential clients use client_secret_basic or client_secret_post, and only SHA-256 hashes of secrets are stored.
Scope resolution	Business authorization is resolved from the connected user's current Membership rows on every call, so scope changes take effect immediately.
Tool safety	Every tool is marked read-only, non-destructive, and idempotent. The server is closed-world: only the listed tools exist, and there is no path to writes.
Transport hygiene	Required HTTP header validation, per-request metadata, result type discriminators, and cache metadata; cross-origin browser access is blocked unless explicitly allowed.

MCP access versus API access tokens

Lucidity's API access tokens are revocable credentials for programmatic integrations, such as an intake webhook or a reporting pipeline. They are intentionally not valid on the MCP server. MCP access represents a person asking an AI client a question: per-user OAuth, per-session consent, and membership scope checked on every call. The two paths never share credentials, so revoking one never silently affects the other.

Connecting a client

An administrator pre-registers the AI client with its exact callback URL, choosing public or confidential client authentication. The user then starts the connection from the AI client, completes the OAuth 2.1 grant with PKCE, and the client's tool list appears. Because tools are read-only, giving a team member an AI assistant never widens what they can change; it only mirrors what they can already see in the dashboard.

MCP across the lead software market

AI connectivity is arriving unevenly across this category. CallRail documents an MCP connector for asking questions about call data, and CTM lists a Claude MCP integration. Check each vendor's current tools, authorization model, and client requirements rather than assuming an API or an AI feature includes MCP support. Lucidity's position: the MCP server covers the objects the dashboard owns, leads, deliveries, analytics, with the same first-party facts, and the same honesty about GA4 lag described in GA4 data freshness for lead reporting.

Comparing vendors on the rest of the stack? Start with Lucidity vs CallRail, Lucidity vs WhatConverts, or the alternatives library.

Frequently asked questions

Does Lucidity have an MCP server?

Yes. A read-only MCP server at the /mcp endpoint, implementing the 2026-07-28 revision with stateless requests, and accepting stateless 2025-era Streamable HTTP requests while clients migrate.

Can the MCP server change or delete my data?

No. Every tool is read-only, non-destructive, and idempotent, and the server is closed-world. There is no write path, and the server never accepts API tokens or browser cookies, only its own OAuth 2.1 grants with PKCE.

Which AI clients can connect?

Any MCP-compatible client, such as ChatGPT or Claude, once an administrator pre-registers it with an exact HTTPS callback allowlist. Public clients use no secret; confidential clients use basic or post authentication with only SHA-256 secret hashes stored.

How is MCP access different from an API token?

API tokens are revocable credentials for programmatic integrations and are never accepted by the MCP server. MCP access is per-user, per-session OAuth 2.1 with PKCE, and business scope is resolved from current membership rows on every call.

Ask your lead data questions in plain language

See the MCP server answer real questions about real leads in a Lucidity demo: businesses, analytics, lead search, and delivery evidence, read-only by design.

Request a Lucidity MCP demo