Skip to content
DimensionKit
Try the app

Connecting a client

The server URL is the only thing you need:

https://app.dimensionkit.com/mcp

Paste it into your client’s “add MCP server” flow. The client registers itself, sends you here to sign in, and asks you to approve what it may do. Nothing is issued by hand — there are no API keys to copy.

If you do not have an account yet

Section titled “If you do not have an account yet”

Start the connection anyway. You will land on the DimensionKit sign-in page with a note naming the client that is waiting, and a link to sign up. Once you have registered and verified your email address, you are returned to the approval screen and the connection completes.

Email verification is required before a connector can be approved.

What you are approving

Section titled “What you are approving”
Scope What it allows
scorecards:read View your scorecards, their configuration, and submissions
scorecards:write Create, edit, and publish your scorecards

A connection granted only scorecards:read cannot call a writing tool; it gets an error naming the scope it is missing. Grant the narrower scope if you only want an assistant to read.

Connections act as you and can access all scorecards and submissions in your DimensionKit account, including those created by teammates. A connection with write permission can edit and publish any scorecard in that account.

After you are connected

Section titled “After you are connected”

Just ask. “Build me a scorecard that assesses technical leadership” is enough — the assistant reads the house style, asks you who it is for and what you want the result to push people toward, builds it, and gives you a preview link before anything is published.

Clients that support MCP prompts also expose three of them as slash commands:

Prompt What it does
build_scorecard Interviews you, then builds and previews a scorecard
review_scorecard Reads an existing one critically and proposes fixes
choose_theme Walks through the themes and palette

Seeing what is connected, how long a connection lasts, and how to cut one off are covered in Managing connections.

Requirements for client authors

Section titled “Requirements for client authors”

The server speaks streamable HTTP, POST only. Specifically:

  • Transport: JSON-RPC 2.0 over POST. GET returns 405 — there is no SSE stream to open and no session to hold. Clients that only implement the 2024-11-05 HTTP+SSE transport cannot connect.
  • Modern protocol: 2026-07-28. There is no initialize handshake. Send params._meta["io.modelcontextprotocol/protocolVersion"] on each request, matching the MCP-Protocol-Version header, and a Mcp-Method header matching the JSON-RPC method. Start with server/discover for server identity and capabilities. tools/call, prompts/get, and resources/read also require Mcp-Name to match the tool name, prompt name, or resource URI respectively (this server does not expose resources). Unsupported modern revisions return an error; they do not negotiate down.
  • Legacy protocol: 2025-11-25, 2025-06-18, 2025-03-26, 2024-11-05. Start with initialize. An unrecognised version in that handshake negotiates down to 2025-11-25.
  • Auth: OAuth 2.1, authorization code with PKCE. Dynamic client registration (RFC 7591) is open, which is what makes pasting the URL enough.
  • Discovery: the 401 from /mcp carries a WWW-Authenticate header whose resource_metadata parameter points at the RFC 9728 document.
  • Redirect URIs: https://, custom schemes such as cursor://, and http:// for loopback addresses only.
  • Revocation: RFC 7009 at /oauth/revoke — see Managing connections.
  • Rate limit: 120 requests per minute per connected account.

Batched JSON-RPC is not supported; send one message per request.

The server’s release version (for example, 1.0.0) is separate from these dated protocol revisions. It matches the DimensionKit application release and the registry listing for that release. Legacy clients receive it in initialize.result.serverInfo.version; modern clients receive it in server/discover.result._meta["io.modelcontextprotocol/serverInfo"].version.

OAuth discovery documents, this documentation, and registry icons are public. An unauthenticated MCP POST should return 401 with the OAuth discovery hint, not an HTML challenge or a Cloudflare 403. If a connector cannot begin sign-in, include the response status and Cloudflare Ray ID when reporting the problem.