Hub MCP actions

The Hub MCP integration connects assistants to account onboarding, teams, applications, channels, messaging, webhooks, workspaces, calendars and wallets. Its separate contract revision is 1.8.0; this is independent of the REST documentation version. This is a predeployment, unreleased contract. The endpoint requires deployment and configuration by the Hub operator before it is available.

Choose a server

• https://docs.chatt2.me/mcp: public documentation search and fetch, without an account.
• https://app.chatt2.me/mcp: Hub operations through OAuth and the same public documentation tools.

The operational server uses remote HTTP. Application API keys and dashboard credentials are not MCP login credentials. The machine-readable contract lists 203 tools: 200 authenticated operations and 3 public onboarding/documentation tools, with their customer-supported schemas, authorization and stable errors. Operational access remains limited to the selected team's current grants; it does not provide Cockpit administration or global account lookup.

Configure your assistant

Current ChatGPT, Codex CLI and Claude Code clients can identify themselves through Client ID Metadata Documents (CIMD). Use the operational endpoint and OAuth; there is no client secret to paste into the assistant. The server accepts the supported official HTTPS identities published by ChatGPT/Codex and Claude. Other clients can use an operator-provided public client ID and registered callback; public Dynamic Client Registration remains disabled.

The token endpoint advertises only the public-client authentication method none. Authorization codes still require PKCE S256 and human consent. This keeps discovery consistent with the registered client and prevents choosing a JWT or shared-secret method that this integration does not support.

ChatGPT: add https://app.chatt2.me/mcp with OAuth authentication and automatic client discovery (CIMD). Complete Hub login and team consent in the browser. Do not select the public documentation server or the no-authentication option.

Codex CLI:

codex mcp add hub-chatt2me --url https://app.chatt2.me/mcp
codex mcp login hub-chatt2me

Claude Code:

claude mcp add --transport http hub-chatt2me https://app.chatt2.me/mcp

Use /mcp in Claude Code to authenticate. Native loopback callbacks accept the port selected at login while matching their published host and path. Web callbacks must match their validated metadata. Older clients can use pre-registration: Codex supports --oauth-client-id; Claude Code supports --client-id and, when needed, --callback-port. Keep existing registrations while their connections are in use. Never distribute a client secret with a public-client configuration.

An unauthenticated initialization returns HTTP 401 with WWW-Authenticate so the client can start OAuth. Public discovery and the tool catalog remain available; private tools publish their OAuth policy in securitySchemes and _meta.securitySchemes. A protected tool called without a token returns an MCP error result with _meta["mcp/www_authenticate"] to open the client's login UI. An invalid presented token still returns HTTP 401.

Availability depends on client version, plan, organization policy and access to the client's metadata server. The provider login/code/PKCE/refresh flows were verified with synthetic metadata; this does not certify every real product version or production deployment. Consult the official ChatGPT authentication guide, MCP instructions for Codex, Claude Code and Claude custom connectors. Do not paste a password, authenticator code, API key or OAuth token into chat.

Complete login and consent in the browser

Create an account or sign in in the Hub browser flow. A new account requires email verification and acceptance of current terms. Account creation alone does not complete MCP authorization. Invited accounts complete the password setup first. An impersonated session cannot authorize a connection.

Select the eligible teams this connection may access and explicitly authorize the client. The selector initially includes every eligible team; deselect unwanted teams individually, or use the single select-all/clear-selection toggle. At least one team must remain selected. With MFA enabled, enter a fresh authenticator code in the Hub consent page; otherwise confirm your password there. Login and consent may each require verification. Requests expire; restart from the assistant if the interaction expires. The displayed client name may be self-reported; it is not proof of the model running behind the client.

Choose a team for each operation

Ask the assistant to list your teams and select one by ID. Keep the returned organizationContextId and include it in each team-specific operation. A context belongs to this connection and team; an arbitrary team ID is not a context. hub_switch_organization can select another already-consented, unexpired team without another MFA confirmation. A team omitted from the original consent needs browser approval before it becomes accessible. Each context retains its own deadline, bounded by the connection consent and current authorization.

The team selected in the Hub dashboard does not change an assistant's context. Two conversations may keep different contexts. Human approval pages always show the team fixed when the action was prepared, even if the dashboard currently shows another team. Verify that team before confirming.

Consent lifetime

MCP consent follows the team's session duration: 1 hour, 24 hours, or unlimited. A null consent expiresAt means no deadline until revoked; current membership and permissions still apply. An unlimited destination cannot extend a finite initial connection. A finite destination keeps its own deadline even when the initial connection is unlimited.

Increasing the team's session duration does not extend consent already given. Reductions can shorten existing deadlines and never restore a longer deadline. Start a new browser consent to receive a longer duration.

Access tokens last at most 15 minutes and use rotating refresh tokens while consent remains valid. Provider browser sessions and consent interactions expire after 15 minutes independently of existing MCP consent. A browser session ending does not disconnect an existing valid consent. Prepared actions still have a finite deadline; follow the returned action expiresAt.

Permissions and MFA

Use MCP (Usar MCP in Portuguese; Usar MCP in Spanish) allows connecting and using tools under the team's current permissions. View team MCP connections (Visualizar conexões MCP da equipe; Ver conexiones MCP del equipo) allows viewing client/activity metadata, without secrets or permission to revoke another person. Domain permissions still govern every resource and operation. Team owners and authorized administrators use the Hub's existing permission rules. Permissions and membership are checked again at use and approval time.

Enable MFA in Profile → Security before confirming an operational write. A fresh authenticator code is required for each prepared write, including message sends, webhook changes and wallet actions. Creating an additional API key directly in the dashboard also requires MFA. Never send the MFA seed, QR code, password or authenticator code to the assistant.

Create an application and its first key

Ask the assistant to prepare an application in the selected context. The browser approval creates the application and its first API key. Do not create an additional key just to finish onboarding. Use an existing application when appropriate.

Example tool arguments (fictional IDs; this is a business payload, not a full JSON-RPC transport message):

{
  "name": "hub_create_application",
  "arguments": {
    "organizationContextId": "33333333-3333-4333-8333-333333333333",
    "name": "Atendimento Loja",
    "idempotencyKey": "44444444-4444-4444-8444-444444444444"
  }
}

The assistant returns an action with outer status: requires_user_action and a confirmationUrl such as https://hub.chatt2.me/mcp/a/VVVVVVVVRVWFVVVVVVVVVQ. Confirmation links use the Hub browser origin configured for the environment; the MCP API endpoint can use a different origin. The short reference is the 22-character canonical base64url encoding of the action UUID's 16 bytes. Existing /mcp/actions/{actionId} links remain supported.

The assistant must show the exact complete URL visibly. Keep the returned URL unchanged; do not hide it behind a label, rewrite it or replace it with a QR code. Open it, verify your account, the client, fixed team and application name, and confirm with MFA in the Hub. The URL only locates an action: browser sign-in, current permissions and human confirmation are still required. Preparing or reading an action does not approve it. To change its details, cancel it and ask for a new preparation. The assistant may check its safe status and receipt afterwards.

Create an additional key and keep its value

Ask the assistant to prepare a key for an existing application, with a label and optional expiry. Expiry must be a valid future date. Confirm in the Hub with MFA. The raw value appears once, only in the browser confirmation response. Reveal and copy it explicitly; store it securely before closing the page. The assistant receives IDs, a mask and secretDelivery: shown_in_hub_on_confirmation, never the raw key. Do not send the key back to the chat.

If the response is lost or you close the page, the value cannot be recovered. A receipt with data.status: completed proves the action finished and the key exists. The outer status can still be requires_user_action when the remaining step is SAVE_API_KEY; that asks you to save the key and does not request another creation. Revoke that key in the Hub and prepare a replacement if you did not save it; do not blindly repeat creation.

Available operational families

The contract contains the complete catalog; these are representative starting points. Team consent never grants access to unrelated resources automatically.

Family	Representative tools	Confirmation or boundary
Applications and keys	hub_get_application, hub_update_application, hub_delete_application, hub_update_api_key, hub_revoke_api_key	Writes use MFA; application deletion moves it to the recycle bin. Key revocation stops integrations using that key.
Teams and access	hub_invite_user, hub_update_member_profile, hub_share_access, hub_transfer_ownership	Current domain permissions and MFA; granted roles cannot exceed the actor's delegable rights.
Account management	hub_update_user_preferences, hub_mark_notifications_read, hub_delete_all_from_recycle_bin, hub_revoke_mcp_connections	Safe metadata only; destructive targets are fixed before confirmation. Security steps finish in the Hub.
Webhooks	hub_create_webhook, hub_configure_webhook_channel, hub_retry_webhook_log, hub_retry_webhook_logs	Public HTTPS destinations and MFA; secrets stay in the browser; retries report each delivery.
Workspaces and files	hub_create_workspace, hub_create_files_batch, hub_confirm_files_batch, hub_create_urls_batch, hub_set_workspace_tool_config	Explicit application/workspace scope and MFA; local files use browser uploads.
Calendar and appointments	hub_set_calendar_page_settings, hub_connect_google_calendar, hub_create_calendar_appointment, hub_handle_calendar_appointment	OAuth and image selection finish in the browser; appointment writes preserve versions and operation IDs.
Sessions	hub_close_session, hub_transfer_session, hub_session_assist, hub_session_cx_score	MFA and application ownership; assistance/CX scoring reuse existing service billing. Transfer reassigns an already-transferred session.
Channel settings	hub_set_channel_ai_config, hub_update_apis2me_config, hub_create_whatsapp_template, hub_create_flow, hub_regenerate_web_chatt2me_public_key	MFA and provider prerequisites; reads omit credentials. Copy a newly rotated widget key from its Hub result.
Messages	hub_send_whatsapp_message, hub_send_instagram_message, hub_send_messenger_message, hub_send_telegram_message, hub_send_sms_message, hub_send_web_chatt2me_message	Each send needs MFA and remains subject to provider windows, media validation, session rules and billing.
Wallets	hub_get_wallet_balance, hub_get_wallet_usage, hub_recharge, hub_delete_card, hub_update_whatsapp_billing	Writes need MFA; recharge continues in Hub checkout. No administrative credit or refund tool is provided.
Connections and sandboxes	hub_authorize_instagram, hub_configure_telegram, hub_configure_whatsapp, hub_connect_apis2me, hub_complete_sandbox	Credentials, provider selection, charge consent and OAuth remain in the authenticated Hub browser.

Confirm changes and interpret receipts

Use one idempotencyKey for one fixed intent. Keep that key when retrying only a transport failure before execution. Preparing a tool returns the action's exact confirmationUrl; it does not mutate the target. After browser confirmation, wait at least five seconds before polling hub_get_action, then inspect the safe receipt and any item-level failures. Independent resources can have independent approvals, but dependent updates and deletions must remain sequential.

An executing action or an uncertain provider outcome is not permission to create a new intent. Inspect its status before deciding what to do. A completed action is never repeated merely because its response was lost. A message receipt of enqueued proves acceptance for processing, not recipient delivery; sent does not prove the person read it. Retry batches can complete with failed items. Follow the provider's current prerequisites instead of resending automatically.

Upload files and calendar images

For local files, call hub_create_files_batch or hub_create_skills_batch with the destination, omitting the optional files or skills metadata list. The person selects or drags files in the Hub, reviews that selection and confirms with MFA. The browser uploads directly to storage. After uploads finish, use the separate hub_confirm_files_batch action to verify and finalize the objects. Explicit metadata lists also work and require matching local files; the assistant must not invent file names or sizes. File contents, signed upload URLs and storage headers are not assistant inputs.

hub_set_calendar_page_settings can retain, reposition, remove or replace public page images during the same browser confirmation. WhatsApp profile photos also use browser file selection. Provider login tools return a human step: a setup URL alone does not prove the account connected. Read the resulting channel state after the person completes setup.

Continue a wallet checkout

hub_recharge fixes the authorized wallet, amount or package, payment method and optional coupon. The confirmed action opens authenticated Hub checkout; it does not make a payment or increase the wallet balance. Enter payer and card details only there. Distinguish a completed checkout handoff from confirmed payment and credited funds. Wallet deletion remains blocked while balances, reservations, debt or payment/refund activity is unresolved.

Manage and disconnect connections

Open Settings → MCP (/mcp). My connections offers the current team or all your teams. You can disconnect your own access after losing MCP permission or leaving a team. Team connections requires the separate read permission and shows only metadata and safe activity.

Client family filters use operator-registered labels: Claude, Claude Code and Claude Desktop appear as Claude; Codex, Codex CLI and OpenAI Codex appear as Codex. Other registered names appear as Other. These labels describe the registration and do not attest vendor identity.

Disconnect from one team, or from all your teams for that client. Revoking another person is limited to an authorized team owner/administrator and requires MFA. Revocation cancels pending approvals; API keys already created remain valid until separately revoked. Team selection in the dashboard does not revoke or switch assistant contexts.

Documentation and recovery

docs_search accepts a public documentation query and a limit from 1 to 20 (default 8 through the Hub; 16 on the standalone docs server). Do not include private account, customer or application data in a docs query. Use docs_fetch with the exact URL returned by search, removing a fragment if necessary. The Hub accepts published /docs/latest/, /docs/1.0/ and /docs/v1/ documentation paths. Search may return Latest and 1.0; choose the version matching the application. Documentation content cannot approve an operation or override Hub permissions.

Problem	Recovery
Login required or expired	Restart the client's browser OAuth login.
Consent interaction expired	Start a new connection request from the client.
Access insufficient	Ask the team administrator for Use MCP and the required domain permission.
Invalid or revoked context	List teams and select an authorized context again; never substitute an unrelated ID.
MFA not enabled	Enable MFA in Hub Profile → Security, then reload the approval; prepare again if expired.
Action denied, canceled or expired	Read its safe status and prepare a new action only when needed.
Documentation unavailable	Follow the local onboarding instructions and retry documentation later.
Key value lost	Revoke the key in the Hub and prepare a replacement.
Client cannot authenticate	Check remote HTTP/OAuth support and client policy; use a compatible client.

The contract includes stable error codes and safe next steps. OAuth failures are transport/authentication failures; business refusals use the tool's documented result envelope. Never retry a completed write simply because its secret was not shown in the assistant.