nenoDevelopers
⌘K
v1

MCP

Connect a client

Add the server URL to your MCP client and sign in to Neno. Clients that can't sign in can use an API key instead.

Add the server

  1. Add the Neno server URL in your AI client's MCP connector settings.
  2. Sign in to Neno, choose the companies to connect and approve the requested permissions.
  3. Ask your question in that AI client and name the company. The client uses the Neno tools available to your connection.

In Claude or Claude Desktop, open Settings, then Connectors, and choose Add custom connector. Paste the server URL, then sign in to Neno and pick the companies to connect.

Server URL
https://mcp.neno.build/mcp

Claude

In Claude or Claude Desktop, open Settings, then Connectors, and choose Add custom connector. Paste the server URL, then sign in to Neno and pick the companies to connect.

Server URL
https://mcp.neno.co/mcp

Claude Code

Add the server, then run /mcp in Claude Code to sign in.

Terminal
claude mcp add --transport http neno https://mcp.neno.co/mcp
 
# Or with an API key instead of signing in
claude mcp add --transport http neno https://mcp.neno.co/mcp \
  --header "Authorization: Bearer $NENO_MCP_KEY"

Cursor

Add this to ~/.cursor/mcp.json, or .cursor/mcp.json in a project. Cursor asks you to sign in the first time it connects.

mcp.json
{
  "mcpServers": {
    "neno": {
      "url": "https://mcp.neno.co/mcp"
    }
  }
}

VS Code

Add this to .vscode/mcp.json in your workspace and start the server from the file. VS Code opens the Neno sign-in.

mcp.json
{
  "servers": {
    "neno": {
      "type": "http",
      "url": "https://mcp.neno.co/mcp"
    }
  }
}

Other clients

Any client that supports Streamable HTTP can connect. If it can't sign in with OAuth, send an API key in the Authorization header.

JSON
{
  "mcpServers": {
    "neno": {
      "type": "http",
      "url": "https://mcp.neno.co/mcp",
      "headers": {
        "Authorization": "Bearer neno_api_live_…"
      }
    }
  }
}

Sign in with OAuth

Most clients sign in by themselves. A request without a token gets a 401 that points to the server's metadata, and the client takes it from there.

HTTP response
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer error="invalid_token",
  error_description="Missing Authorization header",
  resource_metadata="https://api.neno.co/.well-known/oauth-protected-resource/mcp"
  1. It reads the protected resource metadata to find the authorization server, then the authorization server metadata for its endpoints.
  2. It identifies itself with a client ID metadata document, a URL the client hosts. Dynamic client registration isn't supported.
  3. It sends you to Neno to sign in, choose companies and approve scopes. The code exchange uses PKCE with S256.
  4. It gets an access token that lasts an hour, and a refresh token to renew it.
EndpointPath
Protected resource metadata/.well-known/oauth-protected-resource/mcp
Authorization server metadata/.well-known/oauth-authorization-server
Signing keys/.well-known/jwks.json
Authorize/oauth/authorize
Token/oauth/token
Revoke/oauth/revoke

All paths are on https://api.neno.co, or https://api.neno.build for the sandbox.

API keys

For scripts, and clients that can't open a browser, create an API key in the Neno app. A key belongs to one company, carries the scopes you pick when you create it, and can have an expiry date. Send it as a bearer token.

PrefixEnvironmentUse for
neno_api_live_LiveYour real companies
neno_api_test_SandboxDevelopment and testing. The live server refuses these.
cURL
curl https://api.neno.build/mcp \
  -H "Authorization: Bearer $NENO_MCP_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/list" }'

Each key can make 60 requests a minute. Past that, the server answers 429 with a Retry-After header.

The same key works for the REST API. Its scopes decide what it can do on both.

Disconnecting

Remove a connection or revoke a key in the Neno app. It stops working on the next request, even if the client still holds an access token that hasn't expired.