Use Sculptor as an MCP server in Claude Desktop, Cursor, and other clients

Your strategy library already lives in Sculptor. Sculptor as an MCP server lets other AI tools read and act on that workspace without copying markdown into a side chat.

What “Sculptor as MCP server” means

Most of this series is about Sculptor calling other people’s MCP servers. This article is the reverse: Sculptor exposes an HTTP MCP (JSON-RPC) surface so Claude Desktop, Cursor, Open Design-style clients, or internal gateways can call first-party tools backed by your org data.

That is useful when:

• You live in an IDE all day but want library assets and agent-run status from Sculptor.
• You run a company-wide assistant that must respect the same project boundaries as the web app.
• You prototype automations (summarize feedback, list open strategy threads) without building a custom REST integration.

Authentication (pick one)

Unauthenticated requests receive 401 with WWW-Authenticate pointing at OAuth metadata so clients can discover the flow.

Method	How
Browser session	Same cookies as the web app when the client shares your login context
Session JWT	Authorization: Bearer … from POST /api/auth/refresh-session (mobile/API style)
Personal API key	Authorization: Bearer sk_sculptor_… (create in app; stored hashed server-side)
OAuth 2.1 + PKCE	For clients that require RFC 9728 metadata: /.well-known/oauth-protected-resource/api/mcp/http, authorize at /api/mcp/oauth/authorize, token at /api/mcp/oauth/token; access token is the same session JWT usable on other session APIs

Production operators set SCULPT_MCP_OAUTH_ALLOWED_REDIRECT_URI_PREFIXES to tight URL prefixes matching the client’s real redirect_uri (see .env.example and deployment docs). Redis is recommended so authorization codes are single-use across instances.

Connect Claude Desktop

1. Sign in to Sculptor.
2. Open Settings and find Connect Sculptor to Claude or Cursor.
3. Click Copy configuration—JSON shaped like:

{
  "mcpServers": {
    "sculptor": {
      "url": "https://sculptor.scrumdesk.com/api/mcp/http"
    }
  }
}

4. Paste into Claude Desktop config (typically ~/.claude/claude_desktop_config.json on macOS).
5. Restart Claude Desktop; approve the Sculptor connection when prompted (session or OAuth depending on client).

Use the same origin as your deployment (AUTH_URL in production).

Connect Cursor

1. Open Cursor Settings → MCP (or edit the project/user mcp.json per Cursor docs).
2. Add a server entry with the url from Settings (same JSON as above).
3. Ensure you are logged into Sculptor in the browser if the client relies on session cookies; otherwise use a personal API key in headers if your client supports custom headers on HTTP MCP (check client docs—many use OAuth or env-based auth instead).

When Cursor supports OAuth MCP discovery, point it at Sculptor’s well-known metadata URLs under your deployment host.

Tools external clients can call (high level)

Sculptor’s HTTP MCP registry exposes workspace-oriented tools, including:

• Library & documents — sculptor_list_library_files, sculptor_get_document_content, sculptor_search_documents, sculptor_search_all_content
• Collaboration — sculptor_list_document_comments, sculptor_add_comment, sculptor_list_document_tasks, sculptor_create_task_from_comment, sentiment/feedback helpers
• Chat & Agentic — sculptor_list_all_conversations, sculptor_get_conversation, sculptor_list_agent_runs, sculptor_get_agent_run
• Project & team — sculptor_get_project_details, sculptor_list_team_members, sculptor_get_activity_log

Exact parameters (org UUID, project UUID, document keys) mirror in-app access rules—external tools cannot bypass membership checks.

Inside Sculptor chat, separate Sculptor coach tools (sculpt_read_asset, sculpt_write_asset, sculpt_read_ai_skill, …) apply to the in-app agent route; the public HTTP MCP surface focuses on cross-app workspace access as registered in lib/mcp/tool-registry.ts.

OAuth vs API key (which to choose)

• Solo founder on Claude Desktop: session + copied JSON is fastest.
• CI or headless automation: personal API key with least privilege; rotate on offboarding.
• Enterprise MCP hub (Open Design, etc.): OAuth with allowlisted redirect_uri prefixes and Redis-backed codes.

What to prepare

• Active organisation and project with library content you are willing to expose to the external client.
• Decision on read vs write tools (comment/task creation is powerful—treat keys like production credentials).
• Deployment env: AUTH_URL, optional SCULPT_MCP_OAUTH_*, Redis for OAuth hardening.

Who should own this integration

Role	Task
Individual user	Copy MCP config from Settings; keep API keys off shared machines
IT / security	Review OAuth redirect prefixes and egress
Admin	Audit personal API keys and org membership

Examples from the real world (names changed)

Strategy consultant. Used Cursor with Sculptor MCP to pull the latest combined strategy markdown and open comment threads while editing slides—no manual export/email loop.

Corporate innovation lab. OAuth MCP let a approved internal “Open Design” instance list agent runs for a portfolio of ventures without giving the gateway a database login.

Troubleshooting

• 401 — not signed in, expired JWT, or missing API key.
• 500 on MCP preferences / org servers — often schema drift; run prisma migrate deploy and npx prisma generate on the server (see docs/_PRD/mcp.md).
• Client expects Streamable HTTP + SSE — Sculptor’s route is JSON-RPC over POST today; some clients may need transport alignment—watch release notes.

Use this in Sculptor tomorrow

1. Open Settings → copy MCP JSON → paste into Claude Desktop or Cursor → restart the client.
2. Ask the external assistant: “List library files for my active Sculptor project” (with valid org/project context in tool args).
3. Keep doing Strategy Pack work in the app; use MCP when another tool should see that work.
4. To attach external tools into Sculptor chat, read Connect MCP servers to Sculptor.
5. For custom coach tone, add AI Skills.

Keywords: Sculptor MCP server, Claude Desktop MCP config, Cursor MCP settings, HTTP MCP endpoint, OAuth PKCE MCP, strategy workspace tools.