ALL WR, from your AI assistant

Each tool is a different OAuth client

Keycloak does not allow an assistant to register itself. Claude, Grok and ChatGPT/Codex cannot reuse another tool’s client_id: each one is pre-registered with its own redirect URI. Paste Claude’s recipe into Grok and login fails.

Endpoint

The server URL is the same for everyone. What changes is the client_id and how you tell your tool to use it.

https://www.allwr.io/mcp

How to connect each tool

All of them are public clients with PKCE and no secret. The consent screen at login.allwr.io names the tool that is asking.

Claude Code

claude mcp add --transport http --client-id mcp-claude-code \
  --callback-port 29352 allwr https://www.allwr.io/mcp

Claude.ai, Desktop, mobile and Cowork

Add a custom connector pointing at https://www.allwr.io/mcp. In advanced settings set client_id mcp-claude-web. The callback is already registered. If you press Connect without that client_id, claude.ai tries to self-register and fails with "Could not register with the sign-in service": nothing is broken, the client_id is missing.

ChatGPT

When adding the connector, use client_id mcp-chatgpt. ChatGPT shows its own callback; the realm already allows the https://chatgpt.com/connector/oauth/ prefix.

Grok CLI

Grok has no --client-id on grok mcp add. Put the client_id in config. The callback port is random on every login (no need to pin it). Then in the TUI open /mcps and authenticate (i).

[mcp_servers.allwr]
url = "https://www.allwr.io/mcp"
oauth_client_id = "mcp-grok"

Codex CLI

Codex appends an id to the callback path. The port must be 5555 (mcp_oauth_callback_port) to match the realm. Then run: codex mcp login allwr.

mcp_oauth_callback_port = 5555

[mcp_servers.allwr]
url = "https://www.allwr.io/mcp"

codex mcp add allwr --url https://www.allwr.io/mcp --oauth-client-id mcp-codex
codex mcp login allwr

Gemini CLI

Gemini CLI can discover OAuth on its own, but this realm does not allow dynamic registration: you must set the client_id. The callback uses /oauth/callback (not /callback) on port 29354. Then run: /mcp auth allwr.

{
  "mcpServers": {
    "allwr": {
      "httpUrl": "https://www.allwr.io/mcp",
      "oauth": {
        "enabled": true,
        "clientId": "mcp-gemini",
        "redirectUri": "http://localhost:29354/oauth/callback"
      }
    }
  }
}

Antigravity (IDE, CLI and web)

Antigravity is the successor to Gemini CLI. Use client_id mcp-antigravity and omit clientSecret (public client). The fixed callback is already registered. In the IDE: Customizations → Authenticate.

{
  "mcpServers": {
    "allwr": {
      "serverUrl": "https://www.allwr.io/mcp",
      "oauth": {
        "clientId": "mcp-antigravity"
      }
    }
  }
}

Cursor IDE

Add the server to your <code>mcp.json</code> (global <code>~/.cursor/mcp.json</code> or project-level <code>.cursor/mcp.json</code>) using the URL <code>https://www.allwr.io/mcp</code>. In the <code>auth</code> block, set <code>CLIENT_ID</code> to <code>mcp-cursor</code> and <code>scopes</code> to <code>["allwr:mcp"]</code>. Then, go to Cursor Settings → MCP and click <strong>Connect</strong>.

{
  "mcpServers": {
    "allwr": {
      "url": "https://www.allwr.io/mcp",
      "auth": {
        "CLIENT_ID": "mcp-cursor",
        "scopes": ["allwr:mcp"]
      }
    }
  }
}

Perplexity

In Settings → Connectors add a custom connector of type Remote with the URL https://www.allwr.io/mcp. Expand Advanced, pick OAuth and set client_id mcp-perplexity with no secret (public client). Perplexity's callback is already registered, the Enterprise one too. Do not let Perplexity self-register: its dynamic registration fails for public clients.

Your own app

If you wrote your own application or script and it runs on your machine, use client_id mcp-developer with no secret and a loopback callback (http://localhost:<port>/... or http://127.0.0.1:<port>/..., any port). It is a public client with PKCE: you sign in with your account, the consent is issued in your name and the app gets exactly your permissions, nothing more. Any MCP SDK (Python, TypeScript) knows how to run this login. An app deployed with a public callback URL needs its own client: write to support.

Who can sign in

The same account as https://login.allwr.io. You must have signed in through the ALL WR website at least once: the MCP never creates users, it only recognises existing ones.

What it can do

Consent asks for the allwr:mcp scope. On the remote endpoint, task writes, wealth writes (cash, loans, investments) and document drafts are open; billing stays read-only. Everything runs as your session, with the access you already have in allwr.

Another tool

If it is your own app running on your machine, use mcp-developer (above). For a tool or app with a public callback URL, register a public client in the allwr realm (configure-mcp.sh in the infra repo) with its redirect URI. The MCP server is not edited: it implements the spec, not each vendor.