AltOrbit for AI agents (MCP)

Overview

AltOrbit runs a remote server that speaks the Model Context Protocol (MCP), the open standard AI apps use to call outside tools. Add it to your AI client once, and the assistant can work with your AltOrbit workspace: find and read tickets, create and update them, comment, move them across the board, track time and summarise how a project is going. Clients of a studio can follow and manage their own requests the same way.

https://api.altorbit.app/mcp

The server uses Streamable HTTP. Clients sign in with OAuth: you approve the connection on an AltOrbit page, and no password or key is ever pasted into the AI app. Clients that cannot sign in can use a personal access token instead.

What you can do with it

The tools you get depend on your role in the workspace, not on your job title. A few things people ask for:

Connect your AI client

Every client below signs in through AltOrbit's consent page: it opens in your browser, shows which app is asking and what it may do, and asks you to confirm it is you before you approve. Pick the workspace the app should work in there. You can also find this guide, with ready-made buttons, in the web app under Settings › AI agents.

Claude

On claude.ai or in the Claude desktop app, open Settings › Connectors and choose Add custom connector. Name it AltOrbit, paste the server URL and press Add, then Connect and approve the request in AltOrbit. Turn the connector on in a chat from the tools menu.

Once AltOrbit is listed in Claude's connectors directory, you can add it from there instead of pasting the URL.

Claude Code

Run this in a terminal:

claude mcp add --transport http altorbit https://api.altorbit.app/mcp

Then type /mcp in Claude Code, choose altorbit and sign in. Add --scope user to use it in every project, or --scope project to share it with your repository.

Cursor

Use the install link below, then press Connect beside altorbit in Cursor Settings › MCP and approve the request.

Add AltOrbit to Cursor →

Or add it by hand:

{
  "mcpServers": {
    "altorbit": {
      "url": "https://api.altorbit.app/mcp?toolsets=compact"
    }
  }
}

The link and the config use the compact preset, because Cursor counts the tools of all your MCP servers together. Remove ?toolsets=compact to get every tool, or add toolsets after it, such as compact,reports.

VS Code

Use the install link below. VS Code asks you to sign in the first time GitHub Copilot uses an AltOrbit tool in agent mode.

Add AltOrbit to VS Code →

Or add it to your workspace by hand:

{
  "servers": {
    "altorbit": {
      "type": "http",
      "url": "https://api.altorbit.app/mcp"
    }
  }
}

Codex

Add the server to ~/.codex/config.toml, then sign in from a terminal:

[mcp_servers.altorbit]
url = "https://api.altorbit.app/mcp"

codex mcp login altorbit

ChatGPT

In ChatGPT, open Settings › Apps & Connectors › Advanced settings and turn on Developer mode (where your plan offers it). Then choose Create, name it AltOrbit, paste the server URL, choose OAuth and approve the request in AltOrbit.

Windsurf

Open Windsurf Settings › Cascade › MCP servers, choose to edit the raw config and add the server. If Windsurf does not offer to sign in, use a personal access token as shown below. The config uses the compact preset: like Cursor, Windsurf counts the tools of all your servers together.

{
  "mcpServers": {
    "altorbit": {
      "serverUrl": "https://api.altorbit.app/mcp?toolsets=compact"
    }
  }
}

Personal access tokens

For a client or script that cannot sign in with OAuth, send a token in the Authorization header. A token acts as you, in one workspace, with only the permissions you pick.

• In the AltOrbit web app, open Settings › AI agents › Personal access tokens and choose Create token.
• Name it, pick the workspace and the permissions, and confirm it is you. You can set a shorter lifetime.
• Copy the token — it starts with ao_pat_ and is shown only once — and send it as a bearer token.

Authorization: Bearer ao_pat_…

For example:

claude mcp add --transport http altorbit https://api.altorbit.app/mcp --header "Authorization: Bearer ao_pat_…"

{
  "mcpServers": {
    "altorbit": {
      "serverUrl": "https://api.altorbit.app/mcp?toolsets=compact",
      "headers": {
        "Authorization": "Bearer ao_pat_…"
      }
    }
  }
}

Toolsets

Tools are grouped into toolsets. By default a connection gets every tool your role and permissions allow. To offer the AI fewer tools, name the toolsets you want, or a preset; core is always included.

Add ?toolsets= to the server URL with a comma-separated list, for example ?toolsets=tickets,time. A client that cannot change the URL can send the X-MCP-Toolsets header instead; the URL wins if both are set. Unknown names are ignored.

Cursor and Windsurf: the compact preset

Cursor and Windsurf count the tools of all your MCP servers together and stop offering the model any beyond their limit. AltOrbit alone can offer an owner a few dozen tools, so next to other servers some of them may quietly drop out. The compact preset keeps the everyday work — core, tickets, time and client — and leaves out versions, board setup, request decisions, files, reports and notifications. The Cursor and Windsurf setup above already uses it. How many tools each role gets:

Presets and toolsets combine: ?toolsets=compact,reports adds the reports, ?toolsets=compact,files adds files.

The toolset list does not change what you are allowed to do, and the sign-in is the same with or without it.

Tools

Every tool, by toolset. Who is the lowest role that sees the tool; Scope is the permission the connection needs; Type says whether the tool only reads, changes something, or can remove or overwrite something, which AI clients use to decide when to ask you first. Tools name things the way people do: tickets by key (WEB-123), projects by key or name, people by name or “me”, columns, labels and milestones by name. Lists are paginated and long texts are shortened and marked.

Only in the AltOrbit app

Some things stay in the app on purpose: emptying the trash, editing a description together live, seeing who is online, turning chat messages into tickets, managing people, invites and badges, posting revenue, and files over 700 KB.

Prompts

The server also offers ready-made prompts. Clients show them differently — as slash commands in Claude Code, for example.

• my_day — plan your day from your assigned tickets, timer and unread notifications (Team members)
• status_report — draft a status update for a project from its board, flow and estimates (Team members)
• triage_intake — walk through new tickets and client requests nobody has sorted yet (Team members)
• verify_ticket — check a ticket in review against what was asked for (Team members)
• my_requests_status — summarise your requests to the studio and what waits for your answer (Clients)

Permissions

An AI app acts as you. It sees and changes only what you could in AltOrbit yourself, in the one workspace you connected it to, and never more than the scopes you granted. Every rule of the app — who may see money, who may trash a ticket, what a client may edit — is checked by AltOrbit on each call, whatever the AI asks for.

Scopes

Roles

• Team members get ticket, time, report and inbox tools on the projects they belong to. Money fields appear only where their role shows them in the app.
• Owners, company admins and team admins also get the team workload report, board columns and labels, the trash, and deciding on client requests and their budgets.
• Clients of a studio get only client tools, see only what the studio shares with them, and can hold only the profile, projects.read, tickets.read and tickets.write scopes.

If a tool needs a scope the connection lacks, the server answers with 403 insufficient_scope and names it, so your client can ask you to approve more. A tool your role cannot use is simply not offered.

Workspace controls

Owners and company admins decide whether AI apps may work with the workspace at all. They can:

• Turn AI connections off for the whole workspace; they are on by default. Turning them off pauses connected apps and tokens rather than revoking them: every tool call is refused with an error saying your organisation has turned off AI agent access, and no new app can be connected or token created. Turning them back on resumes every app and token that was not revoked or did not lapse meanwhile, without reconnecting.
• See and revoke every AI app and token connected to the workspace, whoever connected it. Its holder is notified when one is revoked.
• Hear about new connections — owners and company admins are notified when a member connects an AI app or creates a personal access token.

Security

How AltOrbit keeps a connected AI app in check:

• Consent with re-authentication — OAuth 2.1 with PKCE. The consent page on app.altorbit.app shows which app is asking, who vouches for it and where access goes. Approving an app or creating a token asks you to confirm it is you, with any one of: a passkey (Face ID or fingerprint), a linked account such as Google, Apple or GitHub, a two-factor code, your password, or a one-time code sent to your email. After you sign in or confirm, you are not asked again for 2 hours; each approval or new token restarts that time.
• Short-lived access — an access token lasts one hour. Refresh tokens change on every use and lapse after 30 days unused, and after 365 days at most.
• Personal access tokens are shown once, lapse after 90 days unused and after 365 days at most (or sooner if you choose), and carry a fixed ao_pat_ prefix so secret scanners can spot a leaked one.
• No stored secrets — tokens are kept only as keyed hashes; we show you the last four characters to tell them apart.
• Checked on every call — your membership, role and client access are read fresh each time, so losing access in AltOrbit cuts the AI app off at once.
• Account events reach agents — resetting your password, changing two-factor sign-in, or signing out of all other sessions also disconnects every AI app and token. An owner or company admin turning AI connections off for the workspace pauses them instead — see Workspace controls.
• Audit trail — the actions AltOrbit audits when you take them in the app, such as ticket, board and request changes, are recorded in the workspace audit log when an AI app takes them too, along with refused attempts. Each record names the tool, the connection and the name the app gave itself.
• Marked in ticket history — every stored version of a ticket says where the change came from: the app, the client portal or MCP.
• Content is data — AltOrbit tells the model to treat titles, descriptions and comments as data and never as instructions, and marks which tools change things so your client can ask you first. Your permissions are enforced on the server either way.
• Rate limits — an AI app meets the same per-user limits as you do in the app.

Revoke access

• Connected apps — in the web app, open Settings › AI agents and choose Disconnect beside the app. Its tokens stop working at once; to use it again, connect and approve it again.
• Personal access tokens — in the same place, choose Revoke. Any tool using the token stops working at once.
• Owners and company admins can revoke any app or token connected to the workspace, or pause them all by turning AI connections off — see Workspace controls.
• Deleting your AltOrbit account removes all of your connections and tokens. You can also remove AltOrbit from your AI client, but only revoking it in AltOrbit ends its access.

Troubleshooting

Support and privacy

Questions or problems with the connector: email support@altorbit.app or use the form on the support page. How we handle data when you connect an AI app is described in our Privacy Policy; security reports go to security@altorbit.app.