Agent integrations
Connect ChatOTL over MCP
ChatOTL exposes an OAuth-protected Model Context Protocol server at https://theunboundai.lovable.app/mcp. Any MCP client — Claude, ChatGPT, Codex, Cursor — can sign in as you and work with your own conversations. Nothing is shared and nothing is public.
1. Server endpoint
Streamable HTTP transport. No API keys, no tokens to paste — authentication is OAuth 2.1 with dynamic client registration.
https://theunboundai.lovable.app/mcp2. Client configuration
Drop the block for your client, restart it, then run any ChatOTL tool to trigger sign-in.
{
"mcpServers": {
"chatotl": {
"type": "http",
"url": "https://theunboundai.lovable.app/mcp"
}
}
}{
"mcpServers": {
"chatotl": {
"url": "https://theunboundai.lovable.app/mcp"
}
}
}# ~/.codex/config.toml
[mcp_servers.chatotl]
url = "https://theunboundai.lovable.app/mcp"Connector name: ChatOTL
MCP server URL: https://theunboundai.lovable.app/mcp
Authentication: OAuth (sign in with your ChatOTL account)3. The OAuth consent flow
- 01Your client discovers /.well-known/oauth-protected-resource and registers itself automatically (dynamic client registration).
- 02You are sent to the ChatOTL authorization endpoint. If you are not signed in, /auth loads first and returns you to the consent page afterwards.
- 03The consent screen at /.lovable/oauth/consent names the requesting client and what it may do: read, search, create, rename, and archive your conversations.
- 04Approve, and the client exchanges its authorization code for an access token scoped to your account.
- 05Every tool call runs as you — row-level security applies, so no other user's data is ever reachable.
Tokens expire and can be revoked by disconnecting the client. A copied browser session token will not work — only tokens issued through this consent flow are accepted.
4. Tools and example calls
JSON-RPC tools/call parameter bodies.
list_conversations
Most recently updated conversations for the signed-in user.
{
"name": "list_conversations",
"arguments": { "limit": 10, "include_archived": false }
}read_conversation
Full message history for one conversation.
{
"name": "read_conversation",
"arguments": {
"conversation_id": "6f1f1e1a-6c4c-4c62-9a53-2f8f5c0f1d21",
"limit": 50
}
}search_messages
Substring search across your own messages.
{
"name": "search_messages",
"arguments": { "query": "row level security", "limit": 20 }
}create_conversation
Start a thread, optionally seeding the first user message.
{
"name": "create_conversation",
"arguments": {
"title": "Deploy checklist",
"first_message": "Draft a release checklist for tonight."
}
}rename_conversation
Rename and/or archive a thread. Pass null to leave a field unchanged.
{
"name": "rename_conversation",
"arguments": {
"conversation_id": "6f1f1e1a-6c4c-4c62-9a53-2f8f5c0f1d21",
"title": "Release checklist",
"archived": false
}
}5. Verifying with curl
Useful when debugging a client that will not connect.
# Unauthenticated probe — returns 401 plus the OAuth metadata pointer
curl -i -X POST https://theunboundai.lovable.app/mcp \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
# Where clients discover the authorization server
curl -s https://theunboundai.lovable.app/.well-known/oauth-protected-resource | jqcurl -s -X POST https://theunboundai.lovable.app/mcp \
-H "Authorization: Bearer $CHATOTL_OAUTH_ACCESS_TOKEN" \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-d '{
"jsonrpc": "2.0",
"id": 2,
"method": "tools/call",
"params": {
"name": "list_conversations",
"arguments": { "limit": 5 }
}
}'