LEMA Chat as an MCP server

LEMA Chat speaks MCP (the Model Context Protocol) in both directions. You can drive your workspace from any MCP client — Claude Code, Codex, or your own framework — and, from the admin side, LEMA Chat can consume external MCP servers too (see Integrations).

This page is about the first direction: connecting your tools to LEMA Chat.

How it works

LEMA Chat exposes a single MCP endpoint at /mcp (streamable HTTP, JSON-RPC 2.0). You authenticate with a personal API key — login tokens are refused, only lcak_… keys are accepted.

The tools you're offered are generated from your own access:

• Chat-asset tools — list, move, and copy docs, files, whiteboards, and widgets across the chats you can see (chat_* tools, each taking a chat_id).
• Workspace tools — list_workspaces, list_chats, create_chat, create_folder, list_groups, list_members, and describe.

Crucially, tools/list is filtered to your effective permissions, and every tools/call is re-checked against the same walls the in-app agents obey. The MCP surface can't exceed what you can do in the UI, and every call is written to the audit log.

Connecting Claude Code

claude mcp add --transport http workspace-chat https://mcp.lemachat.com/mcp \
  --header "Authorization: Bearer lcak_..."

Then just ask in natural language, for example:

"Move these docs into the project chat's docs folder and copy the logos into the branding chat."

…which resolves to list_chats → chat_list_docs / chat_list_files → chat_move_doc / chat_copy_file, all inside your clearance.

Endpoint address

Until the mcp.lemachat.com DNS record is live, the same endpoint is reachable at https://api.lemachat.com/mcp. Ask your admin which host to use.

Calling the endpoint yourself

MCP clients like Claude Code handle the wire format for you. If you write your own client, send each JSON-RPC message as a POST with Content-Type: application/json (the MCP specification requires it). For example:

curl -X POST https://api.lemachat.com/mcp \
  -H "Authorization: Bearer lcak_..." \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/list"}'

The same header is mandatory on the rest of the LEMA Chat API: a JSON body without it is refused with a 422 — see Calling the REST API.

Safety properties

• Owner-scoped — the key acts as you; no capability escalation.
• Idempotent writes — repeated write calls inside a dedup window are refused, so a retry can't double-apply.
• Audited — every call records an mcp.call audit row identifying the key.
• No hidden cost — the MCP tools don't run inference, so they aren't credit-priced today.