Other MCP clients

Any client that speaks MCP over HTTP (Streamable HTTP) and supports OAuth sign-in can connect. Add a server at this URL, and the client opens PlayStep for you to sign in and make your choices on the consent screen:

https://api.playstep.app/mcp

These clients register themselves with PlayStep, so the consent screen shows them as Not verified, with the name they registered under. Your workspace's rules count them as other MCP clients: if your workspace allows only Claude and ChatGPT, an owner or admin can allow other clients in Settings › AI assistants.

VS Code

Add PlayStep to .vscode/mcp.json in your project, or run MCP: Add Server from the Command Palette and choose HTTP:

{
  "servers": {
    "playstep": { "type": "http", "url": "https://api.playstep.app/mcp" }
  }
}

Start the server and VS Code asks you to sign in, then opens PlayStep. Its tools are available in Copilot Chat's agent mode.

Codex

Add PlayStep to the Codex config, then sign in:

[mcp_servers.playstep]
url = "https://api.playstep.app/mcp"

codex mcp login playstep

Gemini CLI

Add PlayStep to your Gemini CLI settings:

{
  "mcpServers": {
    "playstep": { "httpUrl": "https://api.playstep.app/mcp" }
  }
}

Then sign in from Gemini CLI:

/mcp auth playstep

MCP Inspector

The MCP Inspector shows exactly which tools and prompts your connection gets, and lets you call them by hand.

npx @modelcontextprotocol/inspector

In the page it opens, choose Streamable HTTP, paste the URL and connect. It walks you through signing in to PlayStep.

Clients that can't sign in yet

A client can sign in only if it comes back from PlayStep to a web address, to localhost, or to an app link named like a reverse domain (com.example.app:/callback). Cursor comes back to a cursor:// link, so PlayStep refuses its sign-in for now.

For client developers

• Transport: Streamable HTTP, stateless: each POST carries one JSON-RPC message (no batches) and gets JSON back, or a one-event stream for clients on the 2025 protocol versions. GET and DELETE get 405, and the older SSE transport is not supported.
• Discovery: a call without a token gets a 401 whose WWW-Authenticate header points at the protected resource metadata, which names PlayStep's authorization server.
• Client identity: clients with a Client ID Metadata Document on their own https site (claude.ai, ChatGPT) are recognised and shown as verified. Other clients use dynamic client registration, limited to 10 registrations a minute from one address. They show as Not verified, with "(not verified)" after a registered name that mentions Claude, Anthropic, ChatGPT, OpenAI or PlayStep.
• Redirect URIs must be https, http on localhost, 127.0.0.1 or [::1] (any port), or a reverse-domain app scheme with no host, such as com.example.app:/callback (RFC 8252 §7.1).
• Scopes: openid, profile, email and offline_access. What the assistant may do comes from the level chosen on the consent screen, not from scopes.
• Tokens: access tokens last 15 minutes. Clients renew them with a refresh token, so people sign in once. Disconnecting in PlayStep revokes the refresh token, and the next call with any token from that connection is refused.
• Limits: 120 calls a minute for each connection. Over that, the answer is a 429 with Retry-After.