The one rule: a person signs in once
The hosted MCP server athttps://api.graphify.com/mcp uses OAuth. There is no API key for it.
- Sign-in is a browser flow (authorization code with PKCE). A person has to finish it once in a browser.
- Graphify doesn’t offer a device-code flow or a client-credentials flow. An agent can’t sign itself in.
- After the first sign-in, the client keeps working on its own. It asks for
offline_access, gets a refresh token, and refreshes when the access token expires. - Each refresh rotates the refresh token. A client that reuses an old one has to sign in again. See How hosted MCP sign-in works.
401, don’t loop. Tell the person which sign-in step to run, then stop. Agents use Graphify lists what to do while you wait.
What works today
Full step-by-step setup for cloud agents: Connect cloud coding agents.
What doesn’t work yet
- Copilot’s coding agent and code review on github.com. They only support static header credentials, so they can’t use the hosted OAuth endpoint.
- Agents that must sign in with no person ever involved. The hosted server has no flow for that.
When nobody can sign in
Use open-source Graphify instead. Your own infrastructure holds the graph, and you choose the credentials:- Self-host a shared MCP server: run the open-source MCP server over HTTP in Docker behind an API key you control.
- Post impact on pull requests from CI: build the graph and comment on PRs from a CI job, with no MCP sign-in.
Limits to plan for
- 240 requests a minute per client IP and a 256 KB request body. Back off on
429. See Hosted MCP limits. set_workspacebinds a session for 24 hours by default. A bot that runs longer should calllist_workspacesto check which workspace is active.- The graph reflects the last indexed snapshot of the default branch. See Keep answers fresh.
Related
Agents use Graphify
Connect, pick the right tool, and handle sign-in.
Hosted MCP server
Setup, sign-in, workspaces and limits.