Skip to main content
The Tiro MCP server address is https://mcp.tiro.ooo/mcp. Find the setup steps for your client below.
No API key yet? Create one at the Tiro Platform API Keys page. Copy the entire string including the dot, like abc123.xR7mK9pL2qW4.... The full key is shown only once, at creation.

​
Scopes

Scopes define what the MCP server can access on your behalf. MCP scopes share the REST API scope vocabulary with an mcp: prefix. When a client discovers tools, it sees only those allowed by the scopes selected for the connection. * No MCP tool currently maps to this scope (REST API only — all MCP tools are read-only).
  • API keys: the scopes configured on the key apply as-is. On the API Keys page you pick the REST names without the mcp: prefix (note:read, folder:write, …) — the prefix only appears on MCP surfaces such as auth_status. Keys without scopes can use every tool, and write scopes include their read counterpart.
  • OAuth: when connecting, the Tiro consent screen lets you choose None or Read for Notes and Folders. The MCP OAuth flow doesn’t request the write scopes (mcp:notes:write, mcp:folders:write) — see the * note in the table above, no MCP tool maps to them — so a Read & edit level never appears. Your selection is fixed into the token.
Existing tokens and keys issued with the legacy names (mcp:notes:read, mcp:folders:read) keep working.

​
API key types

Which key do you need? Most users start with a user-scoped key — you can search and read all notes you have access to, including notes in team folders, across every workspace you belong to. A workspace-scoped key searches only the workspace it is connected to, and inside that workspace it reads only notes in folders shared with all members (What notes a system API key reads). Use a user-scoped key if you need notes in private folders. MCP tools use the same keys and follow the same read scope rules as the REST API. The folder tools (search_private_folders, search_team_folders) require credentials with user identity (a user-scoped API key or OAuth token) and the mcp:folder:read scope.
API keys do not expire unless revoked from the Tiro Platform API Keys page. We recommend rotating keys periodically and using separate keys for development and production. OAuth tokens are valid for 180 days. To rotate sooner, sign out from your client and sign in again. For immediate revocation, contact support. Once connected, explore what tools are available — or head to Troubleshooting if your client isn’t connecting.