# Claude connector (MCP)

An MCP server that lets Claude read and draw on canvases from outside the app: claude.ai, Claude
Desktop, the Claude mobile apps, or Claude Code. Each person connects with their own Claude account and
acts with their own rights.

## What you can do

- List canvases: personal canvases, daily notes and project canvases.
- Read a canvas, a project's canvas, or a day's daily note.
- Draw: add, change, move, delete and join items in one batch.
- Tidy a canvas into a layered layout.
- Undo a batch.

## How to

claude.ai, Claude Desktop, Claude mobile:
1. In Claude, open Settings > Connectors > Add custom connector.
2. Enter the server address: the app's address followed by `/mcp/canvas`
   (`https://app.siftware.dev/mcp/canvas`; connectors added later use `https://app.siftware.dev/mcp`, which holds the canvas tools too). No client id or secret is needed.
3. Sign in to siftware.dev if asked, then press Connect on the consent page.
4. The connection shows in siftware.dev under Settings > You > Connections > API tokens > Connected apps. Disconnect it
   there.

Claude Code, with a personal token:
1. In siftware.dev, Settings > You > Connections > API tokens: issue a token with `canvas:read`, and `canvas:write` to draw.
2. Run:
   ```sh
   claude mcp add --transport http siftware-canvas https://app.siftware.dev/mcp/canvas \
     --header "Authorization: Bearer <token>"
   ```
3. Or add the server without the header and run `/mcp` in Claude Code to sign in as above.

## Limits

- Claude acts as the person who connected it. A canvas they cannot see is "not found".
- Reading needs `canvas:read`; drawing needs `canvas:write`. A connector sign-in without a scope asked
  for gets read only.
- No making tasks or docs from notes through the connector.
- A bot account's token reaches only the project canvases the bot can write to, never a personal one.
- Client accounts and contact users are refused. The connector sign-in also refuses bookkeepers and bots.
- A connector session lasts 60 minutes and renews for up to 30 days. Disconnecting in Settings ends it.
- Dynamically registered apps show as "Unverified app" on the consent page.

## Related

- [Agent panel](/docs/manual/agents/agent-panel.md)
- [Canvas](/docs/manual/canvas/canvas.md)