Getting started

MCP & OAuth

Connect Codex and other remote MCP clients.

Server URL

Add this URL as a remote Streamable HTTP server in your client. Choose OAuth sign-in when prompted. In UGC.run, choose the projects to authorize and select Allow access. New projects are never added automatically.

In Codex, add the server and authenticate using the commands below. Client support and interface labels can vary.

text

https://www.ugc.run/mcp

Codex setup

bash

codex mcp add ugc --url https://www.ugc.run/mcp
codex mcp login ugc --scopes ugc.read,ugc.write,offline_access

Discover before acting

A request to change billing opens Stripe checkout or the customer portal. It does not silently charge a card. Payment ledger changes record accounting status; they do not transfer funds.

Tool	Purpose
get_context	Your identity, authorized projects, permissions, and query fields
search_operations	Search available operations for a project
get_operation	Read exact input schemas and required permissions
read / write	Execute an operation; writes require an idempotency key
query	Aggregate filtered records without SQL
get_job	Read background job progress
search_docs	Find documentation and operation references

OAuth protocol

UGC.run supports authorization code flow with mandatory S256 PKCE, dynamic client registration, resource indicators, and revocation. Native clients should register application_type=native with an HTTP loopback redirect URI. Browser clients use HTTPS redirect URIs.

Access tokens are opaque, resource-bound, and valid for 10 minutes. Refresh tokens rotate and expire after 30 days. Use resource=https://www.ugc.run/mcp for MCP or resource=https://www.ugc.run/api/v1 for REST. Scopes are ugc.read, ugc.write, and offline_access. Permissions still apply when ugc.write is granted.

Authorization server metadata is at /.well-known/oauth-authorization-server/api/oauth. Protected-resource metadata is at /.well-known/oauth-protected-resource/mcp or /.well-known/oauth-protected-resource/api/v1.

Disconnect a client from Developer to remove its access to the current project. Other separately authorized projects remain connected.