Connect the DFL MCP

Add one connector. It reaches every DFL domain that you approve. You sign in one time, and you approve one time.

The one DFL MCP

https://mcp.devfellowship.com/mcp

The connector shows the DFL icon and the name DevFellowship in the client.

What you get

The connector lists 24 tools:

• 19 core tools, chosen from real use. They are listed directly.
• get_current_actor. It tells you who the connector acts as, what scope it has and which domains you granted.
• 4 router tools: search_tools, describe_tool, call_read_tool and call_write_tool.

The router reaches the rest. 560 tools of the 15 domains can run over OAuth, out of 708 tools in the full catalogue. A tool that a domain does not list for OAuth is refused by the router with “not exposed over OAuth” (for example the Lesson Studio slide-editing tools). Use the bearer-token path for those.

The domains are board, campaigns, engineering, events, financing, learn, ops, payments, plans, proposals, quiz, skills, strategy, studio, work. The consent page offers each domain as one read scope and one write scope, 30 scopes in all.

The core tools

Domain	Tool	Mode
plans	get_plan	read
ops	get_comms_inbox	read
ops	upload_file	write
plans	search_plans	read
ops	list_comms_threads	read
plans	publish_plan	write
plans	create_plan	write
ops	ack_comms_message	write
plans	list_plan_tasks	read
ops	post_comms_message	write
plans	list_questions	read
campaigns	list_post_business_units	read
skills	search_skills	read
ops	get_my_roles	read
campaigns	list_zernio_profiles	read
studio	list_themes	read
work	update_task	write
ops	open_comms_thread	write
work	create_task	write

A core tool shows only when your grant holds the scope of its domain. A write tool also needs the write scope. Each domain page lists every tool and its parameters: all MCP hosts.

The router: reach any other tool

1. Find the tool. Call search_tools with a keyword or an exact name, for example { "query": "campaign analytics" }. Each result gives host.tool, the mode (read or write), a short description, whether your grant allows it, and which call tool to use.

2. Read its parameters. Call describe_tool with the host.tool name. It returns the description and the input schema.

3. Call it. Use call_read_tool for a read tool and call_write_tool for a write tool. Pass the host.tool name and the arguments. Each call tool refuses the other class: a write tool sent to call_read_tool is refused.

The call runs on the domain host with your own token. Row-Level Security and your IAM role apply exactly as with dfl-auth. DFL records each call with the client and the actor. The connector never uses a service key.

Connect your client

Claude Code

claude mcp add --transport http dfl https://mcp.devfellowship.com/mcp

Then run /mcp inside Claude Code, choose dfl, and select Authenticate. Your browser opens the DFL consent page. See The consent page.

Claude.ai

1. Open Settings → Connectors.
2. Choose Add custom connector.
3. Enter the name DevFellowship and the URL https://mcp.devfellowship.com/mcp.
4. Click Connect, sign in on the DFL consent page, and approve.

Cursor and Grok

Add the server in Cursor. Grok reaches DFL through Cursor’s agent MCP OAuth, so one setup serves both.

.cursor/mcp.json

{
  "mcpServers": {
    "dfl": { "url": "https://mcp.devfellowship.com/mcp" }
  }
}

For Grok, add the same URL in Cursor’s agent MCP settings. Cursor returns to https://www.cursor.com/agents/mcp/oauth/callback, which DFL accepts. Sign in when Cursor asks. Cursor requests only the email scope: this is identity only and grants no tool. You choose the real access on the consent page.

ChatGPT

Use the ChatGPT desktop app on your own computer. Do not use an agent sandbox: it cannot reach the DFL hosts.

1. Before the first sign-in, add mcp_oauth_callback_port = 33418 at the top level of ~/.codex/config.toml, above every [section].
2. Go to Settings → Integrations → Plugins → MCPs → Connect to a custom MCP. Choose Streamable HTTP. Enter https://mcp.devfellowship.com/mcp.
3. Click Authenticate, sign in, and approve.

The reasons for the port and the sandbox rule are in Connect an MCP client (OAuth).

After you connect, ask the client to call get_current_actor. A reply with your actor and the granted domains proves the connection works.

The consent page

One sign-in and one approval cover all the domains. The consent page at learn.devfellowship.com keeps your sign-in for 12 hours.

1. Domains. Choose the domains the connector may use. A domain that you leave out is not reachable.
2. Read and write. Read is required. Write is optional. A write tool also needs an actor.
3. This client acts as. Choose Myself or an agent that you delegated, for example grok-capo. A grant without an actor is read-only, even when you selected write.

Each domain keeps its own minimum access level. If your level is below the minimum of a domain, the consent page refuses that domain and names it. Your IAM role still applies to every call.

Manage and revoke

Open learn.devfellowship.com/oauth/grants. You can add or remove write, change the actor, or remove the connection. A removed connection is refused on its next request. See Manage your connections for the details.

The per-domain connectors are closed

Use the one connector

The per-domain OAuth connectors (<domain>.mcp.devfellowship.com, one server per domain) closed on 2026-10-30. A new per-domain OAuth connection is refused, and the refusal message names https://mcp.devfellowship.com/mcp. A connection that you already made works until you remove it. Add the one connector. Then open the connections page and choose Remove this connection for each old one. Removing a connector inside your client does not remove it at DFL.

These stay as they are:

• The <domain>.mcp.devfellowship.com hosts. They are the backends of the one connector.
• The bearer-token path with dfl-auth, for agents and developer clients. See Auth & security.

Troubleshooting

• Discovery fails or the URL does not answer. Use the URL exactly as written: https://mcp.devfellowship.com/mcp, with no trailing slash and no query string. A different path reaches the docs site, not the connector.
• The browser step is refused on the callback. Your client’s callback address is not on the approved list. See the notes in the client tabs.
• A tool is missing from the list. The list depends on your grant. A core tool shows only when its domain scope is granted. Use search_tools to see every tool and whether it is granted.
• 403 insufficient_scope on a write. You approved read only. Open the connections page and choose Add write, then start a new MCP session.
• “not exposed over OAuth”. That tool is not on the OAuth list of its domain. Use the bearer-token path.
• human_actor_required. ops.create_agent and ops.revoke_agent run only when the connection acts as yourself. A connection that acts as one of your agents cannot create or revoke agents. Reconnect and choose myself on the consent page.
• A domain is refused on the consent page. Your access level is below its minimum. Ask a DFL admin.