> ## Documentation Index > Fetch the complete documentation index at: https://docs.insight.nobly.dk/llms.txt > Use this file to discover all available pages before exploring further. # Connecting an assistant > Connect Claude Code, Codex, or the hosted Claude connector to Nobly Insight over MCP, and the connection details worth knowing before you do. ## Prerequisites * AI assistant access is provisioned for your tenant. * Your user group holds at least one MCP permission — see [Granting access](/mcp/granting-access). Without one the connection succeeds and offers nothing. * You know your Insight API address. It appears in the commands below as ``. ## Command-line assistants ### Claude Code ```bash theme={null} claude mcp add --transport http insight https:///api/v3/mcp \ --client-id nobly-mcp --callback-port 48123 ``` You are sent to your usual sign-in page. Once you have signed in, the assistant acts as you. The port is not arbitrary — see [Why the port is fixed](#why-the-port-is-fixed) below. ### Codex Set the callback port in `config.toml`: ```toml theme={null} mcp_oauth_callback_port = 48123 ``` Confirm the client-id setting and the default callback path against a real sign-in before you rely on this in a rollout. The registered addresses allow any path on the loopback host, so the path itself is not the risk — the setting name is what varies between versions. ## Hosted Claude connector Claude on the web and Claude Desktop connect through Anthropic's own callback addresses rather than a port on your machine. Those addresses are **not** allowed by default, so this does not work until someone adds them. Someone holding **Manage API clients** opens **Settings → Access → API clients** and adds these two addresses to the MCP client: ``` https://claude.ai/api/mcp/auth_callback https://claude.com/api/mcp/auth_callback ``` Point it at `https:///api/v3/mcp` and sign in when prompted. Leaving these off is a deliberate default: it means a tenant only reaches an outside service once someone has decided it should. ## For Nobly staff and consultants The `nobly-mcp` client belongs to your organisation's own sign-in realm. If you sign in with a Nobly account instead, use the client that already exists there: ```bash theme={null} claude mcp add-json insight '{"type":"http","url":"https:///api/v3/mcp","oauth":{"clientId":"nobly-cli","callbackPort":48120,"authServerMetadataUrl":"https:///realms/nobly/.well-known/openid-configuration"}}' ``` The permissions still apply in full: a Nobly account reaches only what its own groups and document rights allow. ## Connection details worth knowing ### Why the port is fixed The sign-in service matches the callback address exactly, and does not accept "any port" for local addresses. An assistant that picks a random port each run will fail to complete sign-in, so the port has to be one that has been registered — `48123` for your organisation's users, `48120` for Nobly accounts. ### Allowed addresses are per tenant Which callback addresses are accepted is your tenant's decision, managed in **Settings → Access → API clients**. Out of the box only the local addresses above are allowed. Anyone holding **Manage API clients** can add others — a fixed-port local tool, or the hosted connector addresses. Removing the local addresses stops command-line assistants from signing in. They are restored whenever the sign-in service is updated, so removing them is a temporary measure, not a lock-out. ### Sessions are short, and refresh tokens rotate Access tokens last five minutes, and refresh tokens rotate: using one issues a replacement and retires the one you used. A well-behaved client handles this without you noticing. A tool that caches a refresh token and keeps presenting the same one instead of the replacement will have its session ended, and you will be asked to sign in again. ### Your token is your token The credential an assistant holds is an ordinary Nobly Insight sign-in for your account. It is not restricted to assistant use, and it carries no protection against being reused elsewhere — so treat it exactly as you would your own password, and do not paste it into tools you would not sign into directly. ## Troubleshooting | Symptom | Likely cause | What to do | | ----------------------------------------------------------- | ---------------------------------------------------- | ---------------------------------------------------------------------------------- | | Sign-in never completes, browser reports a redirect problem | The assistant chose a port that is not registered | Pin the port to `48123` (or `48120` for a Nobly account) as in the commands above | | Connects, but the assistant reports no capabilities | The user's groups hold no MCP permission | Grant at least **MCP: View Catalog** — see [Granting access](/mcp/granting-access) | | A capability is missing while others work | That specific permission is not granted | Each capability is a separate permission; grant the one you need | | Searches return fewer results than expected | The person's own document access rights are narrower | Expected — the assistant is bounded by what that person can reach | | The hosted connector fails to sign in | The connector callback addresses have not been added | Add them under **Settings → Access → API clients** | | Signed in this morning, asked again now | The session expired, or a refresh token was replayed | Sign in again; if it recurs immediately, the client is mishandling refresh tokens | ## Where to read next How data sources, dashboards, and elements fit together for the people who build and view reports. The permissions that decide which capabilities a user group's assistants may use. Sign in to Nobly Insight with your organisation's own identity provider.