Skip to content
DimensionKit

Connecting a client

The server URL is the only thing you need:

https://app.dimensionkit.com/mcp

Paste it into your client’s “add MCP server” flow. The client registers itself, sends you here to sign in, and asks you to approve what it may do. Nothing is issued by hand — there are no API keys to copy.

If you do not have an account yet

Section titled “If you do not have an account yet”

Start the connection anyway. You will land on the DimensionKit sign-in page with a note naming the client that is waiting, and a link to sign up. Once you have registered and verified your email address, you are returned to the approval screen and the connection completes.

Email verification is required before a connector can be approved.

What you are approving

Section titled “What you are approving”
Scope What it allows
scorecards:read View your scorecards, their configuration, and submissions
scorecards:write Create, edit, and publish your scorecards

A connection granted only scorecards:read cannot call a writing tool; it gets an error naming the scope it is missing. Grant the narrower scope if you only want an assistant to read.

Connections act as you, and reach only your own scorecards.

After you are connected

Section titled “After you are connected”

Seeing what is connected, how long a connection lasts, and how to cut one off are covered in Managing connections.

Requirements for client authors

Section titled “Requirements for client authors”

The server speaks streamable HTTP, POST only. Specifically:

  • Transport: JSON-RPC 2.0 over POST. GET returns 405 — there is no SSE stream to open and no session to hold. Clients that only implement the 2024-11-05 HTTP+SSE transport cannot connect.
  • Protocol versions: 2025-11-25, 2025-06-18, 2025-03-26, 2024-11-05. An unrecognised version negotiates down to 2025-11-25.
  • Auth: OAuth 2.1, authorization code with PKCE. Dynamic client registration (RFC 7591) is open, which is what makes pasting the URL enough.
  • Discovery: the 401 from /mcp carries a WWW-Authenticate header whose resource_metadata parameter points at the RFC 9728 document.
  • Redirect URIs: https://, custom schemes such as cursor://, and http:// for loopback addresses only.
  • Revocation: RFC 7009 at /oauth/revoke — see Managing connections.
  • Rate limit: 120 requests per minute per connected account.

Batched JSON-RPC is not supported; send one message per request.