> ## Documentation Index
> Fetch the complete documentation index at: https://coding-1afcb9be.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Client integration

> Connect stdio and Streamable HTTP MCP clients to Coding Tools MCP.

# Client integration

Coding Tools MCP can be launched by a client over stdio or reached over HTTP at `/mcp`. Choose stdio for local editor-style integrations and HTTP for long-running local or remote services.

## Stdio client configuration

Use this pattern when the client starts the server process:

```json theme={null}
{
  "mcpServers": {
    "coding-tools": {
      "command": "coding-tools-mcp",
      "args": ["--stdio", "--workspace", "/path/to/workspace"]
    }
  }
}
```

Stdio does not use Bearer auth because the client owns the subprocess. The workspace should be the project directory the model is allowed to inspect and modify.

## HTTP client configuration

Start the server:

```bash theme={null}
coding-tools-mcp --workspace /path/to/workspace --host 127.0.0.1 --port 8000
```

Then point the client at:

```text theme={null}
http://127.0.0.1:8000/mcp
```

For remote or non-loopback HTTP, add auth:

```bash theme={null}
export CODING_TOOLS_MCP_AUTH_TOKEN="replace-with-a-strong-token"
coding-tools-mcp --workspace /repo --host 0.0.0.0 --port 8000 --auth-token "$CODING_TOOLS_MCP_AUTH_TOKEN"
```

The client must send:

```text theme={null}
Authorization: Bearer replace-with-a-strong-token
```

## OAuth mode

For clients that support OAuth 2.1 Authorization Code + PKCE, enable:

```bash theme={null}
coding-tools-mcp --host 0.0.0.0 --port 8000 --oauth-mode
```

Useful environment variables include `CODING_TOOLS_MCP_SERVER_URL`, `CODING_TOOLS_MCP_OAUTH_CLIENT_ID`, `CODING_TOOLS_MCP_OAUTH_CLIENT_SECRET`, `CODING_TOOLS_MCP_OAUTH_PASSWORD`, and `CODING_TOOLS_MCP_OAUTH_TOKEN_SECRET`.

The server exposes OAuth metadata through the standard well-known endpoints when OAuth is enabled.

## Tool discovery

After `initialize`, clients should call `tools/list`. The active tool set depends on `--tool-profile`:

* `full` exposes all implemented tools.
* `read-only` hides mutating and permission-changing tools.
* `compat-readonly-all` is for compatibility with clients that require `readOnlyHint: true` annotations.

## Session behavior

HTTP responses include an `Mcp-Session-Id` header. If a later request sends an unknown `Mcp-Session-Id`, the server returns an unknown-session error. Stdio sessions are tied to the subprocess lifetime.

## Recommended client defaults

* Prefer `--stdio` for single-workspace local usage.
* Prefer HTTP plus Bearer token or OAuth for a persistent service.
* Start with `--tool-profile read-only` for inspection-only clients.
* Use `--permission-mode trusted` only when the client needs to run local development commands that safe mode blocks.
* Avoid `dangerous` unless the whole server is already inside an external sandbox.