Connect an assistant (MCP)

How to give ChatGPT, Claude or Cursor access to the help desk — without code and without a key.

What this is

MCP (Model Context Protocol) is the common language AI assistants use to talk to other people's systems. We run our own MCP server on top of this same API: you hand over an address, the application works out what your help desk can do, and from then on you ask in plain words.

Without it, an employee who wants to know «how many conversations went unanswered yesterday» needs a developer. With it, they ask.

The server does not replace the API: the tools call the same methods, and the same rate limits and the same subscription wall apply. Everything in these guides about idempotency and rate limits applies here too. The one difference: a person connects, not a key — see below.

Address

One: https://api.tg-desk.com/mcp.

What the assistant may do — «Read» or «Read and write» — is a property of the connection, not of the address. You pick it when connecting and can change it later in the console without reconnecting.

https://api.tg-desk.com/mcp/readonly still answers for anyone who pasted it earlier: on it, no writing tool exists whatever the connection allows. New connections do not need it — the switch does the same thing.

Connecting

In the console: Settings → API & MCP, the «MCP connection» block. The address is there, along with the list of applications already connected.

The rest depends on the application:

Claude Desktop, Cursor, VS Code — easiest through the application's own UI, under MCP servers or connectors.

If you edit the settings file by hand, the key differs per client:

// Claude Desktop and Cursor
{ "mcpServers": { "tygy": { "url": "https://api.tg-desk.com/mcp" } } }

// VS Code — in .vscode/mcp.json
{ "servers": { "tygy": { "url": "https://api.tg-desk.com/mcp" } } }

The application opens a browser, you sign in, and you choose what to allow: «Read» — it looks at conversations, contacts and numbers; «Read and write» — it can also close, reassign, tag and write to the help centre.

ChatGPT — add the address as a connector. The rest is the same: sign in, pick a mode, done.

Your own code — no browser needed: send an ordinary API key as Authorization: Bearer <key>. The key and its scopes then decide what is allowed.

Whose access the assistant uses

Yours. A connected application gets exactly your permissions — your role and your conversation visibility, the same as in the inbox — and nothing wider. «Read» narrows that further.

A key is for one case: giving an assistant less than you have — a contractor's, say, or a third-party service. The consent screen carries a folded «Act with a key instead of as me» line, folded because it is not normally needed.

What the assistant can do

The tools are whole tasks, not a one-to-one copy of the API. «Find conversations waiting for a reply» is one tool, not three calls in a row.

The permission comes from your role (or from the key's scopes, if you connected with a key) and is then narrowed by the connection's mode.

The tool list is assembled for that one connection. On «Read» the writing tools do not exist at all — not «exist but refuse», genuinely absent. A model cannot talk itself into calling something it cannot see.

A reply and a first message always wait for a human

This is the one action that reaches an outsider, and it works unlike every other — «Read and write» does not change it.

When the assistant calls «reply to a customer», nothing is sent. What comes back is a link:

{
  "status": "awaiting_human_confirmation",
  "confirm_url": "https://app.tg-desk.com/acme/mcp/confirm/…",
  "expires_at": "2026-09-13T13:54:55.207Z",
  "message": "Nothing has been sent. Show a person this link."
}

An employee opens it, sees the conversation and the exact text that would go out, and presses Send or Discard. The confirmation is good for an hour.

«Write to a customer first» (start_conversation) works the same way: the confirmation page shows who, which channel and what will go out, and the conversation appears only after Send is pressed. Approving it takes the right to start conversations.

The check is on our side, not in the application: the assistant cannot skip it, however it is asked to.

Someone else's text is marked as such

Everything the customer wrote — the body, the subject, a name, an article title — reaches the model wrapped:

<untrusted-content source="customer.body">
Hello! I forgot my password…
</untrusted-content>

That is data, not instructions. Markers inside the text itself are neutralised, so the block cannot be closed from within and escaped.

Permissions and plans

Connecting is for whoever may manage the API in the console (integrations.manage_api) — normally the owner or an admin. A plan that includes the public API is required.

If the subscription lapses the server does not go dark; it drops to reading only, so you keep seeing your own data.

Disconnecting or narrowing

Settings → API & MCP → «Connected applications». Each application has a «Read» / «Read and write» switch and a «Disconnect» button. Disconnecting kills that application's tokens at once. If you connected with a key, revoking the key kills everything issued under it.