> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gomry.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP Server

> Let Claude and other AI assistants read your Gomry data directly via the Model Context Protocol

# Gomry MCP Server

The Gomry MCP server lets AI assistants like **Claude**, **Cursor**, and **Claude Desktop** read your organization's data directly — events, attendees, forms, applications, payments, contacts — without you copying anything by hand.

It's the same data the [Public API](/introduction) exposes, but instead of writing HTTP calls, you give your AI client a single URL and it discovers the available tools on its own.

<Note>
  **Best for:** analyzing form submissions, summarizing attendee lists, querying payments, exploring contacts, and building one-off workflows where writing code would be overkill. **Not for:** programmatic integrations — use the [Public API](/introduction) for those.
</Note>

## What you can ask

Once connected, your AI assistant can answer questions like:

<CardGroup cols={2}>
  <Card title="Form submissions" icon="clipboard-list">
    "What did people answer on form X? Group the responses by question."
  </Card>

  <Card title="Attendee analysis" icon="users">
    "Who's checked in vs. still pending for next week's event?"
  </Card>

  <Card title="Payment review" icon="credit-card">
    "Show me last month's successful payments by event."
  </Card>

  <Card title="Cross-resource" icon="layer-group">
    "Which contacts have submitted applications but never paid?"
  </Card>
</CardGroup>

## How it differs from the API key

|                 | Public API (`X-API-KEY`)                 | MCP Server (token)                         |
| --------------- | ---------------------------------------- | ------------------------------------------ |
| **Who uses it** | Your code                                | An AI assistant                            |
| **Auth header** | `X-API-KEY`                              | `Authorization: Bearer …` or `?token=…`    |
| **Stored in**   | Firestore `api_keys` collection          | Firestore `mcp_tokens` collection          |
| **Setup**       | Per-integration, in code                 | One URL, pasted into Claude / Cursor once  |
| **Scope**       | Per-resource scope map                   | Your dashboard RBAC privileges             |
| **Surface**     | All public REST endpoints (read + write) | 14 organizer read tools + 5 contacts tools |

The two systems are independent — your API keys won't authenticate MCP calls and your MCP tokens won't authenticate API calls.

## Security model

* Every MCP token is **tied to one user in one organization**. Calls are scoped to that org server-side; an MCP client can never read another organization's data.
* Tool visibility mirrors your **dashboard privileges**. If you can't see attendees in the dashboard, the `list_attendees` tool isn't even advertised to your client.
* Tokens are **revocable from the dashboard**. Revocation takes effect within 5 minutes (token cache TTL).
* The endpoint is **rate-limited** at 120 requests per minute per token.

## Next steps

<CardGroup cols={2}>
  <Card title="Setup" icon="play" href="/mcp/setup">
    Generate a token and connect Claude / Cursor in under two minutes.
  </Card>

  <Card title="Available tools" icon="wrench" href="/mcp/tools">
    The full list of MCP tools and what they return.
  </Card>
</CardGroup>