# Connect an AI assistant (MCP)

> Connect an AI assistant to QueryHippo over MCP: the endpoint, personal access tokens, client setup, read-only tools and result limits.

**Source:** [https://queryhippo.com/docs/mcp](https://queryhippo.com/docs/mcp)

QueryHippo is an MCP server. Any AI assistant that supports remote MCP over HTTP, and lets you set a custom `Authorization` header, can read your Search Console evidence.

## Endpoint

```
https://queryhippo.com/mcp
```

The endpoint uses MCP Streamable HTTP with stateless JSON responses. Requests are sent with `POST`; `GET` and `DELETE` return `405`.

## Authentication

Send a personal access token as a Bearer token on every request:

```
Authorization: Bearer <YOUR_PERSONAL_TOKEN>
```

- Create tokens in the dashboard under **Connect your AI**. Tokens start with `qhpat_`.
- A token lasts 30 days. You can copy it again while it is active, and revoke it there at any time.
- Your Google and Clerk credentials are never sent to the AI client. Keep your tokens private.

**No OAuth yet.** OAuth sign-in for hosted MCP clients is not implemented. Use a client that lets you set a custom `Authorization` header.

## Client setup

### Generic JSON configuration

Many clients accept a server entry in this shape:

```
{
  "url": "https://queryhippo.com/mcp",
  "headers": {
    "Authorization": "Bearer <YOUR_PERSONAL_TOKEN>"
  }
}
```

### Claude Code

```
claude mcp add --transport http queryhippo https://queryhippo.com/mcp --header "Authorization: Bearer <YOUR_PERSONAL_TOKEN>"
```

Replace `<YOUR_PERSONAL_TOKEN>` with a token from Connect your AI.

## What a token can see

A token grants exactly the properties its user can already see in QueryHippo: the properties you own, plus the ones another user has explicitly granted to you. Nothing else.

## Read-only tools

Every tool is read-only. Tools never start collection and never call a model: QueryHippo returns measured evidence, and your assistant's model explains it.

- Results carry source labels. Fixture and synthetic data are always labelled as such.
- Errors are returned as safe error codes.

## Source notice

If your Google connection needs attention, or the data may be stale, results include a second text block, the **QueryHippo source notice**. Your AI assistant should relay it to you before drawing conclusions.

## Size limits

Results are size-limited, usually to 128 KiB. Some lists are shortened to fit, and the result says so when that happens.

## Browser origins

Requests from a browser carry an `Origin` header, and that origin must be an allowed one. Command-line and desktop clients that send no `Origin` header are fine.