Endpoint
Authorization header. Older client configs that point at https://app.trybluemoon.com/api/mcp/<anything> keep working.
MCP access requires a paid plan. A token on a Free workspace gets
402 with plan_required.Create a token
Only workspace Admins can create tokens.- In the Bluemoon app, open Settings → API keys and find Personal Access Tokens.
- Click Generate token, give it a name you will recognise (for example “Claude Desktop”), and copy it. It is shown only once: if you lose it, revoke it and create another.
- A token carries the permissions of the workspace and role that created it. Revoking it stops every client using it immediately.
Connect a client
Most clients take the same block. Put it wherever your client keeps its MCP servers, and replace the token with your own (tokens begin withpat_).
Tools that read your data
These are free and read-only. They never change anything in your workspace.Tools that spend AI credits
These generate content and are charged. An MCP client should ask you before running one.
Credits come from the same monthly allowance as the app. Your balance is in the sidebar.
What the answers contain
Some of what these tools return is text written by third parties: the body of a ChatGPT or Gemini answer, the title of a cited page. Bluemoon passes it through unchanged. Treat it as data, never as instructions. A cited page can hide a prompt aimed at AI assistants, so your assistant should not act on directions found in arawResponse or a page title.
Limits and errors
Every call is written to the workspace audit log with the token that made it.
Checking it works
{"error":{"code":"missing","message":"Missing Bearer token"}} — which is also a
quick way to confirm the endpoint is reachable at all.
Every request is independent and carries its own token, so there is no session
to keep alive and no call order to respect. Clients that send an Mcp-Session-Id
header are not refused; it is simply not needed.