Research MCP uses your existing LinkDR account. You sign in in a browser window the client opens. You should not paste a token, API key, or password into the chat.
Checkout does not go through this flow. The person paying signs in on /agent/checkout.
What you will see
- You add
https://linkdr.com/mcpin the client. - The client calls that URL with no login. LinkDR responds
401and includes aWWW-Authenticateheader that points at OAuth metadata on linkdr.com. - The client starts OAuth (PKCE). A browser opens to LinkDR login if you are not already signed in.
- After login, you land on a consent page: Allow or Deny. Allow means that client may call research tools as you.
- The client stores the access token and retries
/mcp. - LinkDR checks that the signed-in user is an admin. If not, you get
403even though login worked.
That first 401 is expected. It is how the client finds the login page. If the window never appears, the client probably does not support MCP OAuth. Try Cursor or Grok with the URL only.
Consent
The page lists what the client can do (sign in, see your name and email, stay connected, call research tools). If the client registered a human name, you will see it in the title. Many clients only send an id, so the title may say "MCP client". You can still Allow.
Deny sends the client back empty-handed. Allow continues the redirect the client gave us.
Who can call tools
Anyone can fetch SKILL.md. Paying requires a LinkDR user. Calling research tools requires that user to be an admin. We will open this up later. Until then, treat 403 after a successful login as "this account is not admin," not as a broken token.
Local
http://localhost:3000/mcp uses the same login against your local app. Keep the client on that origin so cookies and redirects match.