Start with your brand
Model Context Protocol

The Zenflow Connector

Read your brand context, projects and creative direction from Claude, ChatGPT or any MCP client. One endpoint, one token, read-only.

POSThttps://www.zenflow.media/api/mcp
01

Overview

The connector is a Model Context Protocol server that lets an AI tool read your Zenflow organization — the brand kit, the projects, their status, activity and creative direction — from inside the conversation. Ask Claude “what's the status of the winter campaign?” and it answers from your actual project, not a guess.

TransportStreamable HTTP
AuthBearer token
AccessRead-only
Tools5
Before you start
  • A Zenflow account with the Manage connector tokens permission.
  • A connector token — mint one in your dashboard (next section).
  • An MCP-capable client: Claude, ChatGPT, or the Messages API.
Use the canonical host

Point your client at the www URL exactly as written. The bare zenflow.media redirects to it, and some MCP clients handle a redirect on a POST poorly — so skip the redirect and use https://www.zenflow.media/api/mcp.

02

Quickstart

Three steps from zero to asking your AI about a live project.

01
Get a token

Sign in, open Dashboard → Settings, and mint one under Connector access. It's shown once — copy it then.

02
Add the connector

Register the endpoint with your client and pass the token as a Bearer credential — the fastest path, in Claude Code:

bashClaude Code
claude mcp add --transport http zenflow \
https://www.zenflow.media/api/mcp \
--header "Authorization: Bearer zmcp_YOUR_TOKEN"
03
Ask

“List my Zenflow projects,” or “what's left before the winter campaign ships?” — the AI calls the tools and answers from your data.

03

Connect a client

Everywhere, the shape is the same: the endpoint above, your token as a Bearer credential. Pick your client.

claude mcp add --transport http zenflow \
https://www.zenflow.media/api/mcp \
--header "Authorization: Bearer zmcp_YOUR_TOKEN"
Keep it out of shell history

The Claude Code command lands your token in ~/.zsh_history. On a shared machine, export it first — export ZMCP=zmcp_… — and pass "Authorization: Bearer $ZMCP", or revoke it when you're done.

The Messages API also needs the beta header anthropic-beta: mcp-client-2025-04-04.

04

Tool reference

Five read tools. The tag by each name is what your role must carry — read means any valid token works; a named capability means that one tool stays quiet without it while the rest keep working.

get_brand_contextView brand kit

A compiled, timestamped snapshot of a brand workspace. Optionally focus on one project.

ReturnsBrand identity, visual system, the active campaign and recent approval signal.
workspaceIdrequiredThe workspace to snapshot.
projectIdoptionalNarrow the snapshot to a single project.
asOfoptionalISO timestamp — reconstruct context as of a past moment.
list_projectsread

Every project you can read in the organization, including ones with no workspace. Optionally filter to one workspace.

ReturnsProjects with name, phase, deadline and workspace.
workspaceIdoptionalRestrict the list to a single workspace.
get_project_statusread

The current state of one project.

ReturnsPhase, deadline, brief, objectives and deliverable counts.
projectIdrequiredThe project to read.
get_activity_timelineread

Recent activity on a project.

ReturnsEvents with type, actor and timestamp, newest first.
projectIdrequiredThe project to read.
limitoptionalHow many events to return (1–50, default 25).
get_direction_docread

The creative direction for a project — the latest doc unless you name one.

ReturnsConcepts, shot list and notes.
projectIdrequiredThe project to read.
directionDocIdoptionalA specific direction doc; defaults to the latest.
Denials are uniform

Every id you pass is checked against your own access before a row is read, and every denial returns the same “not found or not accessible” — so a token can never be used to probe which projects exist in an org you can't see.

05

Scope & security

What a token can and cannot reach — worth reading before you hand one to an AI.

Read-onlyFive tools that fetch. Nothing writes, deletes, generates or spends money.
Bound to one organizationA token is scoped to the org it was minted in. It cannot read another org's projects — not even yours, if you belong to more than one.
Inherits your role, never exceeds itThe token sees exactly what its creator can. A Viewer's token reads like a Viewer. get_brand_context needs the View brand kit capability; without it that one tool returns nothing while the other four still work.
Revocable and auditedEvery call writes an audit row — tool, actor, outcome. Revoke from the dashboard and the token stops working on its next request.
Stored hashedWe keep only a SHA-256 of the token. It is shown once at creation and is not recoverable afterward — not by you, not by an admin.

The workspace that remembers.

Add your brand book, your logos and last year's approved campaign. Then ask for the dog from last year's cultural campaign.