Connect an assistant (MCP)
How to give ChatGPT, Claude or Cursor access to the help desk — without code.
What this is
MCP (Model Context Protocol) is the common language AI assistants use to talk to other people's systems. We run our own MCP server on top of this same API: you hand over an address, the application works out what your help desk can do, and from then on you ask in plain words.
Without it, an employee who wants to know «how many conversations went unanswered yesterday» needs a developer. With it, they ask.
The server does not replace the API. It runs on the same permissions, the same limits and the same keys. Everything in these guides about scopes, idempotency and rate limits applies here too.
Addresses
| Address | What it gives |
|---|---|
https://api.tg-desk.com/mcp | Everything the key allows, changes included |
https://api.tg-desk.com/mcp/readonly | Reading only — no action at all, even if the key allows one |
The second address is a safety catch, not a convenience. An assistant reading customer correspondence is reading text a stranger wrote, and that text may carry instructions aimed at the model. On the read-only address there is simply nothing to carry them out with.
Connecting
In the console: Settings → API & MCP, the «Connect an assistant» block. Both addresses are there, along with the list of keys and how many actions each one unlocks, and the list of applications already connected.
The rest depends on the application:
Claude Desktop, Cursor, VS Code — easiest through the application's own UI, under MCP servers or connectors.
If you edit the settings file by hand, the key differs per client:
// Claude Desktop and Cursor
{ "mcpServers": { "tygy": { "url": "https://api.tg-desk.com/mcp" } } }
// VS Code — in .vscode/mcp.json
{ "servers": { "tygy": { "url": "https://api.tg-desk.com/mcp" } } }The application opens a browser, you sign in, and you choose what to allow: look, or look and act.
ChatGPT — add the address as a connector. The rest is the same: sign in, pick a key, done.
Your own code — no browser needed: send an ordinary API key as Authorization: Bearer <key>. The key then decides what is allowed.
When a key is still the right answer
One case: giving an assistant less than you have — a contractor's, say. The consent screen carries a folded «Act with a key instead of as me» line, folded because it is not normally needed.
What the assistant can do
The tools are whole tasks, not a one-to-one copy of the API. «Find conversations waiting for a reply» is one tool, not three calls in a row.
| Task | Scope required |
|---|---|
| Who am I, which project is this | — |
| Find and read conversations and messages | conversations:read |
| Reply to a customer | messages:send |
| Leave an internal note | notes:write |
| Close, reassign, tag | conversations:write |
| Find a person or a company | contacts:read |
| Create and edit a record | contacts:write |
| Search the help centre | kb:read |
| Write a help-centre article | kb:write |
| Meetings, summaries, transcripts | conferences:read |
| Reports and numbers | analytics:read |
The tool list is assembled for that one connection. On «Read» the writing tools do not exist at all — not «exist but refuse», genuinely absent. A model cannot talk itself into calling something it cannot see.
A reply to a customer always waits for a human
This is the one action that reaches an outsider, and it works unlike every other.
When the assistant calls «reply to a customer», nothing is sent. What comes back is a link:
{
"status": "awaiting_human_confirmation",
"confirm_url": "https://app.tg-desk.com/acme/mcp/confirm/…",
"expires_at": "2026-09-13T13:54:55.207Z",
"message": "Nothing has been sent. Show a person this link."
}An employee opens it, sees the conversation and the exact text that would go out, and presses Send or Discard. The confirmation is good for an hour.
The check is on our side, not in the application: the assistant cannot skip it, however it is asked to.
Someone else's text is marked as such
Everything the customer wrote — the body, the subject, a name, an article title — reaches the model wrapped:
<untrusted-content source="customer.body">
Hello! I forgot my password…
</untrusted-content>That is data, not instructions. Markers inside the text itself are neutralised, so the block cannot be closed from within and escaped.
Permissions and plans
Connecting is for whoever may manage the API in the console (integrations.manage_api) — normally the owner or an admin. A plan that includes the public API is required.
If the subscription lapses the server does not go dark; it drops to reading only, so you keep seeing your own data.
Disconnecting
Settings → API & MCP → «Connected applications» → «Disconnect». That application's tokens die at once. Revoking the key itself kills everything issued under it.