Nametag MCP Server

Overview

The Nametag MCP server lets AI assistants operate Nametag on your behalf using the Model Context Protocol (MCP), the open standard for connecting AI applications to external tools. Once connected, you can ask an assistant to:

• Create a verification and send the link by SMS or WhatsApp — “Create a verification link for Alice Smith and text it to +1 202 555 1212.”
• Check a verification result — “Has the verification for ticket 4821 been completed?”
• Locate accounts — “Which accounts does Alice Smith have?” or “Has alice@example.com been verified?”
• Check recovery status — “Is this account eligible for an MFA reset?”
• See integrations — “Which identity providers are connected to this environment?” — and get a console link to add one.

Every action runs through the same public Nametag API with the same permissions, so an assistant can never do anything you couldn’t do yourself.

The server is hosted by Nametag — there is nothing to install or run. You authorize a client once, in your browser, using your Nametag Console account.

• Endpoint: https://nametag.co/mcp
• Transport: Streamable HTTP
• Authorization: OAuth 2.1 (Authorization Code + PKCE, with Dynamic Client Registration)

Before you start

• MCP must be enabled for your organization. It’s off by default — contact Nametag to turn it on.
• MCP must be enabled for each environment you want to use. An administrator turns it on per environment in the Console under Settings (the toggle appears once your organization has the feature). A connection can only ever access environments where MCP is enabled — if it’s later turned off for an environment, existing connections immediately lose access to it.
• You need a Nametag Console account. When you connect, you’ll sign in and choose which environments and access level to grant.
• The MCP server works with any MCP-capable client. Setup for the most common ones is below.

Connect your assistant

When you first use the connection, your client opens a Nametag page in your browser. Sign in to the Console, pick the environment and access level, and select Allow. The client stores the resulting token; you won’t be asked again until it expires.

Claude (Claude.ai and Claude Desktop)

1. Open Settings → Connectors (Claude Desktop: Settings → Connectors).
2. Select Add custom connector.
3. Enter the URL: https://nametag.co/mcp
4. Save, then select Connect and complete the Nametag sign-in.

Claude Code

claude mcp add --transport http nametag https://nametag.co/mcp

Then run /mcp inside Claude Code and choose Authenticate to complete sign-in.

Cursor

Add the server to ~/.cursor/mcp.json (global) or .cursor/mcp.json (per project):

{
  "mcpServers": {
    "nametag": {
      "url": "https://nametag.co/mcp"
    }
  }
}

Cursor prompts you to authenticate the first time a Nametag tool is used.

VS Code (GitHub Copilot / agent mode)

Add to .vscode/mcp.json:

{
  "servers": {
    "nametag": {
      "type": "http",
      "url": "https://nametag.co/mcp"
    }
  }
}

ChatGPT

In ChatGPT, open Settings → Connectors → Advanced → Developer mode, then Add connector and enter https://nametag.co/mcp. Complete the Nametag sign-in when prompted.

Any other MCP client

Point the client at the Streamable HTTP endpoint https://nametag.co/mcp. The client will discover the authorization server automatically via protected-resource metadata and walk you through sign-in. No client ID or secret is required — the server supports Dynamic Client Registration.

Access levels

When you authorize a client, you choose an access level. Each maps to a set of capabilities:

You also choose which environments the connection can access — only environments where MCP is enabled are offered. A connection never has more access than the Console account that authorized it.

Available tools

See the MCP tool reference for the full, always-current list of tools, their parameters, and the access level each requires. That page is generated directly from the server.

Security

• You are always in the loop. Authorization happens in your browser with your Console credentials. You pick the environment and access level.
• Least privilege. Tokens carry only the scopes for the level you granted and are bound to the specific environments you selected.
• Standard OAuth 2.1. The server uses Authorization Code flow with PKCE and binds every access token to the MCP resource (RFC 8707), so a token issued for Nametag cannot be replayed elsewhere.
• Revocation. Disable a connection at any time from the Console. Access tokens are short-lived; refresh tokens can be revoked.

Troubleshooting

• “Please specify which environment to use.” Your connection has access to more than one environment. Tell the assistant which one, e.g. "…in the production environment," or reconnect scoped to a single environment.
• “This connection does not have the … scope.” The action needs a higher access level than you granted. Reconnect and choose Standard or Admin.
• The browser sign-in didn’t open. Make sure pop-ups are allowed, or copy the authorization URL your client prints into a browser manually.