GoldNovaAI
Docs

MCP connection

GoldNovaAI is a remote MCP server at https://goldnovaai.com/api/mcp. A workspace owner or admin connects an MCP-compatible client; the client then uses a scoped set of tools. An MCP connection never has more authority than the workspace role and scopes you grant it; it cannot manage billing, API keys or secrets.

Connecting

  • OAuth 2.1 (clients that support remote MCP connectors): the client discovers the server, you sign in, choose the workspace and approve the permissions. Access tokens last 1 hour, refresh tokens 30 days, and tokens are bound to this endpoint.
  • Static bearer credential: create one in Organization & API → Integrations → MCP, choose its scopes and send Authorization: Bearer gnk_…. The secret is shown once and only a hash is stored.

Connected through the OAuth flow in real clients during release testing (2026-10-16, read-only, synthetic data): ChatGPT custom connectors and the claude.ai connector. Treat other clients, including Claude Code, as untested. Other clients that follow the MCP specification should work but have not been tested.

Workspace isolation

A credential belongs to exactly one organization; the organization is derived from the credential, never from anything the client sends. Every read and write goes through the same organization-filtered code as the REST API. Another organization’s call id behaves as “not found”. Research data is additionally limited to the person who made the connection.

Scopes

A new connection is read-only by default. Tools outside a connection’s scopes are not offered and cannot be called.

ScopeAllowsWrites
calls:readList calls and read call details.no
calls:writeAdd calls to the workspace. Counts toward the call allowance of the current period.yes
qa:readRead call reports, findings and the evidence quoted from the transcript.no
qa:evaluateRe-evaluate a call against the current policy.yes
policy:readRead the rules every call is checked against.no
usage:readRead the plan and this period’s usage: QA calls, audio transcription minutes and AI assessments against their allowances.no
research:readRead research projects, quotes, themes and findings created by the person who made this connection.no
research:writeCreate research projects owned by the person who made this connection.yes

Tools

Calls

  • list_calls (calls:read): List recent calls with result, QA score and finding counts. Filter by result, severity, agent, source or date. Paginated.
  • get_call (calls:read): Get one call’s details. The transcript is returned only when include_transcript is true.
  • ingest_call (calls:write): Add a call with a transcript. Idempotent on external_call_id. Evaluation runs after the call is accepted. Counts toward the monthly allowance.

QA

  • get_call_report (qa:read): Get the QA report for a call: result, score, highest severity, findings with quoted evidence, and rule results.
  • list_findings (qa:read): List findings (potential violations and review items) with their quoted evidence, for one call or across the most recent flagged calls.
  • evaluate_call (qa:evaluate): Re-evaluate a call against the current QA policy. Runs in the background; read the report afterwards.

Policy

  • get_qa_policy (policy:read): Get the QA policy: every rule with its type, severity and enabled state.

Usage

  • get_usage (usage:read): Get the plan and this period’s usage of QA calls, audio minutes and AI assessments, the allowances and when they reset.

Research

  • list_research_projects (research:read): List the research projects created by the person who made this connection.
  • get_research_project (research:read): Get a research project with its interviews, themes and findings (summaries).
  • search_research (research:read): Search quotes, themes and findings in the connection owner’s research projects.
  • get_research_quote (research:read): Get one quote with its source interview and timestamp.
  • get_research_finding (research:read): Get one finding with the quotes that support it.
  • create_research_project (research:write): Create a research project (title and research question). Interviews are added in the app.

There is no tool for passwords, billing, account or organization deletion, API keys, provider secrets or configuration.

Tool errors

A failed tool call returns an error with one of these codes and a message written for the agent (no backend details).

  • invalid_input, not_found (also for another workspace’s data), forbidden, insufficient_scope, rate_limited (120 requests per minute per connection, Retry-After: 30), quota_exceeded, conflict, not_ready, unavailable, internal_error.
  • An invalid, revoked or expired credential gets HTTP 401 invalid_token; a REST API key on this endpoint (or an MCP credential on the REST API) gets 403.
  • ingest_call accepts scalar metadata values only and no recordingUrl, which is narrower than the REST API.

Limits and revocation

  • One JSON-RPC message per request (batches are refused); rate limited per connection; write tools count against the same allowances as the REST API.
  • Revoke a connection or an OAuth grant in Organization & API → Integrations → MCP; the next request is refused with 401.
  • Connections are audited (who authorized, which tool was called), without transcript content.
Docs: MCP connection · GoldNovaAI