*MCP › Connect*

# Connect Claude Code

> Add Filmo to Claude Code with OAuth, or with an API key that stays out of your repository.

## Before you start

| What | What the vendor documents |
| --- | --- |
| Plan | No plan restriction is stated for servers you add yourself. |
| Who adds the connector | You, with `claude mcp add`. On Team and Enterprise, only admins add connectors at claude.ai/customize/connectors; managed settings can allow or deny servers. |
| Who connects | You authenticate with `/mcp` (OAuth) or send your own key. |
| Administration | Managed settings: `allowedMcpServers`, `deniedMcpServers`, `managed-mcp.json`. |

verified on 2026-10-09: [Connect Claude Code to MCP servers](https://code.claude.com/docs/en/mcp) · [Permissions](https://code.claude.com/docs/en/permissions)

> **Use exactly this URL:** Type `https://app.filmo.io/api/v1/mcp` exactly. Do not use the Filmo domain of your company or any other host: the OAuth metadata names this origin, and a client that compares it with what you typed rejects a different one.

## Connect with OAuth

1. **Add the server** Run the command below.
2. **Authenticate** In a session run `/mcp`, choose filmo and authenticate; or run `claude mcp login filmo` in a shell.
3. **Consent in Filmo** An administrator chooses the subscription and the scopes in Filmo's consent screen; see below.

- When `oauth.scopes` is not set, Claude Code requests the scope of the 401 `WWW-Authenticate` header or of the resource metadata, and sends none when neither has one. Filmo's 401 carries the read scopes.
- On a `403 insufficient_scope` it fails with “needs additional permissions”; there is no automatic step-up. Add the scope to `oauth.scopes` and authenticate again.
- It uses a loopback redirect (`http://localhost:<port>/callback`); `--callback-port` fixes the port.

## The consent screen

- Only the `*:read` scopes the client asked for are checked (every read scope when it asks for none).
- Write scopes, `workflows:run` and `ai:ask` always start unchecked, even if the client asks for them; the ones it asked for carry the label “Requested by the integration”.
- Check by hand only what the assistant needs, and leave `ai:ask` unchecked unless you want it to spend AI credits.

To change the scopes later, remove the connector and add it again.

Before you approve, read [Authentication](https://docs.filmo.io/mcp/authentication#before-you-approve).

## Connect with an API key

1. **Put the key in your environment** Export `FILMO_API_KEY` from your shell profile or a secrets manager. Use that exact name or one of your own: the credential-like names Claude Code reserves (such as `ANTHROPIC_API_KEY` or `NPM_TOKEN`) read as empty in remote headers.
2. **Add the server in the user scope** The command below stores the entry in your user configuration, outside any repository.
3. **Or share a project file without the key** In `.mcp.json` the header carries `${FILMO_API_KEY}`, never the value, so the file is safe to commit.

**Command**

```bash
claude mcp add --transport http filmo --scope user https://app.filmo.io/api/v1/mcp \
  --header "Authorization: Bearer $FILMO_API_KEY"
```

**.mcp.json**

```json
{
  "mcpServers": {
    "filmo": {
      "type": "http",
      "url": "https://app.filmo.io/api/v1/mcp",
      "headers": {
        "Authorization": "Bearer ${FILMO_API_KEY}"
      }
    }
  }
}
```

- Never use `--scope project` with a literal key: that scope writes `.mcp.json`, which Claude Code's documentation suggests checking into version control.

> **Keep the key out of the repository:** Never paste an API key into a file that goes to version control. The examples read it from the environment or ask for it; if one leaks, revoke it and create another.

## Limits of this client

| What | What the vendor documents |
| --- | --- |
| Tools | There is no fixed per-server tool cap; tool search defers the definitions, so the budget is your context window. |
| Output | It warns above 10,000 tokens of output and cuts at 25,000 by default (`MAX_MCP_OUTPUT_TOKENS`); a text result over 50,000 characters is saved to a file unless the tool sets `_meta["anthropic/maxResultSizeChars"]` (up to 500,000). Each description is cut at 2,048 characters. |
| Time | Per-tool `timeout` in the server entry; a call over two minutes goes to the background by default. |

## Recommended preset

Rental operations (21): `orders:read`, `orders:write`, `availability:read`, `items:read`, `contacts:read`, `account:read`. Claude Code defers tool definitions, so the preset is about what the key may do, not about context. It includes the order writes, cancelling included; for read-only work pick a preset marked (read).

Every preset and its size are in [Limits and context](https://docs.filmo.io/mcp/guides/limits-and-context).

## What to put on “ask before running”

Permission rules `mcp__filmo` (the whole server) or `mcp__filmo__<tool>`. A tool with `_meta["anthropic/requiresUserInteraction"]: true` asks on every call, in every mode, with no “don't ask again”.

The tools that must ask for approval are in [Safe writes](https://docs.filmo.io/mcp/guides/safe-writes#requires-confirmation).

- Claude Code does not auto-approve by `readOnlyHint` or `destructiveHint`: it is not in its documentation.

## Check the connection

Ask the assistant: “Which Filmo account am I connected to?” It should call `filmo_account_get`, a read tool that returns no personal data.

---

Canonical URL: https://docs.filmo.io/mcp/connect/claude-code  
Last updated: 2026-10-25