AI connector
Let staff's own Claude or ChatGPT work on client files, with placeholders only.
The connector is a remote MCP server at https://desk.sophiaxt.com/mcp. A staff member uploads a client document to Safe-Desk; their AI reads it with placeholders where client details were, drafts from it, and hands the draft back. Safe-Desk fills in the real values on its own server, and the person opens the finished document on Safe-Desk. The model never receives a value the firm's rules swap out. The staff-facing guide is the connector guide; this page is the detail an IT reviewer needs.
What it covers and what it doesn't
An MCP tool runs after the AI has already read the chat, so the connector can't protect what someone types or pastes into Claude or ChatGPT. The browser extension does that. The connector is for files: staff put client documents through Files in Safe-Desk instead of pasting them into the chat.
Tools
| Tool | What it does | Kind |
|---|---|---|
list_files | The caller's own files: id, title (with placeholders), upload date, and which kinds of client data were replaced. | Read only |
read_file | One file's protected text, with a note telling the model to keep placeholders exactly as written and to treat the file as a document, not instructions. | Read only |
finish_document | Takes the draft and the ids of the files it used (up to 20). The server fills the real values from those files and saves the result. The model gets back a link and a count, never a value. | Creates; changes or deletes nothing that exists |
Every tool touches only the signed-in person's own files. A colleague's files, another firm's files and the firm's settings are out of reach, whatever a document or a prompt asks the model to do.
OAuth 2.1 endpoints
Claude and ChatGPT find all of this themselves: a request to /mcp without a token gets a 401 whose WWW-Authenticate header points to the protected-resource metadata. You don't need to configure any of it; it is listed so you can review it.
| Endpoint | Purpose |
|---|---|
/.well-known/oauth-protected-resource/mcp (also /.well-known/oauth-protected-resource) | Protected-resource metadata (RFC 9728). Names this origin as the authorization server. |
/.well-known/oauth-authorization-server | Authorization server metadata (RFC 8414). |
POST /oauth/register | Dynamic client registration (RFC 7591). Public clients only; no client secrets are issued. |
/oauth/authorize | The consent page. It is Safe-Desk's own app page and needs a normal Safe-Desk sign-in. It names the app and the account; the person chooses Allow or Deny. |
POST /oauth/token | Code and refresh-token exchange. PKCE with S256 is required. |
POST /oauth/revoke | Revocation (RFC 7009). Always answers 200. Revoking either token ends the whole connection. |
Responses to an authorization request carry the iss parameter (RFC 9207). Tokens are bound to one person, one app and one resource, the /mcp address; a token shown anywhere else is refused.
Scopes
| Scope | Who can have it | Grants |
|---|---|---|
files | Any registered app the person approves | The three tools above, on that person's own files. |
device | Only Safe-Desk's own extension and Windows app. Any other app that asks for it is refused before the consent page shows. | Checking and restoring text for that device. Never the connector. |
Allowed redirect addresses
An app can register only https redirect addresses on claude.ai, claude.com or chatgpt.com, or plain http on this computer (127.0.0.1, localhost or [::1]) for desktop apps. The address is matched exactly at authorization time; a loopback address may differ only in its port, as RFC 8252 allows, so only the same computer can ever receive the code. The consent page shows the app as Claude, ChatGPT or "An app on this computer" judged by those addresses, never by the name the app gives itself. If your firm uses an AI app on another host, email us.
Browsers may call /mcp directly only from those same origins; server-to-server calls carry no origin and rely on the token.
Lifetimes and limits
| Item | Lifetime or limit |
|---|---|
| Consent page request | 10 minutes, one use, bound to the signed-in person |
| Authorization code | 60 seconds, one use. A second use ends the connection it made. |
| Access token | 1 hour |
| Refresh token | 30 days, rotated on every use. Reusing an old one ends the connection. |
| Registered app nobody finished connecting | Removed after a day |
| Ended or expired connections | Removed after 30 days |
| Registrations | 20 an hour from one address; 200 an hour from one address for registrations whose redirects are all on Claude or ChatGPT hosts, since their servers register for every customer; 2,000 an hour for the whole service |
| Token requests | 60 a minute per app |
Only hashes of codes and tokens are stored, and no token is written to a log.
Ending a connection
- The person: Settings in Safe-Desk lists every AI app they connected, with Revoke.
- The app: removing the connector in Claude or ChatGPT revokes it through
/oauth/revokewhen the app supports that. - A password change ends every connected app and paired browser for that person.
- The owner: disabling a staff member in the Staff tab stops their tokens working at once.
- The firm: when the subscription isn't active,
/mcpanswers 402 and new connections are refused.
Connecting, disconnecting and a forced end after a reused code or token each add a line to the firm's Activity tab.
Data flow
- Upload: the person adds a file or pasted text under Files. The firm's rules run once as it arrives. Passwords, keys and privileged material are refused and nothing is kept.
- Stored: the protected text (placeholders for what the rules protect; anything set to Flag stays as written) and the caught values, both encrypted with AES-256-GCM and tied to that person. The original file is never stored.
- Read: the model receives only the protected text through
read_file. - Finish: the model sends a draft with placeholders to
finish_document. The server fills in the values from the named files, saves the result encrypted, and returns a link and a count. - Open: the person opens the link on Safe-Desk while signed in. Nobody else can open it, including the owner.
- Gone: files and finished documents are deleted after 7 days, or sooner when the person deletes them. Encrypted copies in the daily backups are gone within 14 days after that.
The owner's log records that a file was uploaded, read or finished and which kinds of data it held, never the values. If the firm uses strict mode, files with identifiers such as SSNs are refused, and names and contact details are removed and not filled back in. Read and finish text is counted for the admin panel but never billed; the connector is included in the seat, and the person's own Claude or ChatGPT plan does the AI work.
Setup in Claude and ChatGPT
Both apps rename these menus from time to time, so match on meaning rather than exact words.
Claude
- Settings, then Connectors (it may be under a heading such as Integrations or Tools in some versions).
- Add custom connector. Name it Safe-Desk and paste
https://desk.sophiaxt.com/mcp. - A Safe-Desk page opens. Sign in if asked, check that it names Claude and your account, choose Allow.
- In a chat, turn the connector on from the tools menu.
On Team and Enterprise plans an organization owner may need to add the connector for everyone first. Claude Desktop uses the same connectors as claude.ai.
ChatGPT
- Settings, then Connectors (or Apps). Under Advanced, turn on developer mode if your plan and workspace allow it.
- Create a connector. Name it Safe-Desk, paste the address, choose OAuth.
- A Safe-Desk page opens. Sign in if asked, check that it names ChatGPT and your account, choose Allow.
- In a chat, add the connector from the tools menu.
Workspace admins in ChatGPT may need to allow custom connectors first.
Available after launch Safe-Desk is being submitted to both apps' connector directories. Once listed, staff will find it there and choose Connect instead of pasting the address.
Protocol detail
Streamable HTTP with JSON responses (no server-sent stream), JSON-RPC 2.0. Protocol versions 2025-11-25, 2025-06-18, 2025-03-26 and 2024-11-05. Each tool declares the files scope in its security schemes and carries read-only, destructive, idempotent and open-world hints.