XOi connector

XOi connector

Connect your AI assistant to XOi.

One connector for the parts of XOi your assistant can work with. You choose what each assistant may do in each part.

Connector URL

https://mcp.dev.xoeye.com/mcp

What it can do

The connector covers these parts of XOi. When you connect, you choose what the assistant may do in each one.

Customers

Find possible data problems. The assistant explains them; you decide.

  • find_duplicate_customersRead only
    Find Customers that may be the same Customer.
  • find_sparse_customersRead only
    Find Customers with missing details.

Sites

Find possible data problems, and fill addresses you approve.

  • find_duplicate_sitesRead only
    Find Sites that may be the same place.
  • find_sites_named_as_addressesRead only
    Find Sites whose name is their street address.
  • find_sparse_sitesRead only
    Find Sites with missing details.
  • stage_site_address_fix
    Stage a fix that fills those Sites' empty address fields.
  • await_site_address_fix_approvalRead only
    Wait for you to approve or reject the fix on an XOi page.
  • apply_site_address_fixNeeds your approval
    Apply a fix you approved.

Feedback

Tell XOi what you need or what went wrong.

  • submit_feedback
    Send XOi a feature request or a bug report, after you agree to the exact text.

How to connect

Add the connector URL to your assistant. Then sign in with your usual XOi account. The assistant acts as you: only in your organization, and only as your role allows.

Claude

  1. Open Settings, then Connectors.
  2. Select Add custom connector.
  3. Paste the connector URL, then sign in to XOi.

Claude Code

Run this command, then sign in to XOi when Claude Code asks.

claude mcp add --transport http xoi https://mcp.dev.xoeye.com/mcp

VS Code

Run MCP: Add Server from the Command Palette. Select HTTP, paste the connector URL, then sign in to XOi.

ChatGPT

Add a custom connector in ChatGPT settings. Paste the connector URL, select OAuth, then sign in to XOi.

To see the apps connected to your XOi account, and to remove one, open Connected apps.

Security questions

These answers are for XOi administrators and IT and security reviewers.

Does each connection make a new app client in XOi sign-in?

No. When an app registers, this server stores nothing and makes nothing in XOi sign-in (Amazon Cognito). The client ID it returns is a signed record of the app's redirect addresses and name. Every sign-in goes through one fixed sign-in client that XOi owns. That client is confidential: it has its own secret, and only this server holds it. Nothing piles up, so there is nothing to clean up.

Can anyone register a client and use it to phish for consent?

Not from a web page. This server refuses a registration unless each redirect address is one of these:

  • An exact match for a hosted callback of Claude, VS Code, VS Code Insiders and ChatGPT:
    • https://claude.ai/api/mcp/auth_callback
    • https://claude.com/api/mcp/auth_callback
    • https://vscode.dev/redirect
    • https://insiders.vscode.dev/redirect
    • https://chatgpt.com/connector_platform_oauth_redirect
  • A plain http address on the person's own computer (localhost, 127.0.0.1 or ::1).

A web page cannot register its own address. So it can never receive a sign-in code, and consent phishing needs that code. A desktop app on the person's own computer can still use a local address: see Limits we know about. Also:

  • Only public clients can register, with the authorization-code and refresh grants only.
  • Each sign-in must use PKCE with S256. A code is useless without the verifier that only the app has, and it expires after 5 minutes.
  • A client can register at most 10 redirect addresses. Its name is cut to 100 characters, with control characters removed.

Could a fake web page collect refresh tokens?

No. A sign-in code goes only to a registered redirect address, so a web page never gets one. The tokens also give little to steal:

  • This server encrypts the access and refresh tokens it gives out. They work only on this server, not on other XOi APIs.
  • This server never gives out the ID token from XOi sign-in.
  • A refresh token works only here, and only with the client ID of the app that got it. The app has no secret, so anyone who has both the token and the client ID can use them. A refresh token lasts at most 30 days.
  • Each refresh gives the app a new refresh token. The earlier token stops working a few seconds later.
  • An access token lasts 15 minutes. When it expires, the app must refresh. If an administrator disables the person's XOi account, or XOi removes the app's access, that refresh fails. So access stops within 15 minutes.

Does the person approve each app?

Yes. The first time an app signs a person in, this server shows a consent page. The page names the app and what the app can do. The person chooses Allow or Deny. The page shows again when the app can get more access than the person chose before, or when the app asks the person to choose again.

Can XOi remove the access of one app?

Yes. A person removes the access they gave an app on Connected apps, and an app can revoke its own tokens at this server's revocation endpoint. XOi support can also revoke the access that one person gave to one app. After a revoke, the app cannot refresh its tokens. Tokens that the app got before the revoke stay refused, also after the person allows the app again. An access token that the app already has works until it expires, at most 15 minutes after the revoke.

Should this connector use a separate user pool?

It does not need one. A registration makes nothing in XOi sign-in, and the tokens work only on this server. A separate pool would give each person a second XOi account, apart from their organization and role.

What data can the assistant see?

Only what the person can see. This server acts as the signed-in person, in their organization and role, and only in the parts of XOi the person allowed when they connected.

Is registration rate-limited?

Yes. One network address can register 10 clients in one hour.

Limits we know about

  • A desktop app on your computer can use the local address, as with any desktop sign-in. Connect only apps that you trust.
  • A revoke does not stop an access token that the app already has. That token works until it expires, at most 15 minutes.
  • The approval page does not ask for your password again while your XOi sign-in is active in that browser. So an assistant that controls your browser could open an approval link and approve it. Do not let an assistant control a browser where you are signed in to XOi.

Report a concern

Contact your XOi administrator or XOi support.