Integrations

MCP server

Contaktly speaks the Model Context Protocol, the open standard assistants use to read tools. Connect Claude, ChatGPT, Cursor, n8n or an agent of your own and ask it about the companies on your website in plain words. This page is for whoever sets that up.

Address: https://app.contaktly.com/api/mcp
Transport: Streamable HTTP, stateless
Sign-in: Your Contaktly account (OAuth 2.1), or a workspace API key
Cost: Included in every plan; reads spend nothing

What you get

Three read tools and one ready-made prompt. The assistant can list the companies identified in a date range, look at one company in depth, people and CRM records included, and read your ideal customer profile so it knows which visitors matter. Everything is read-only: nothing the assistant does through this server changes your workspace or spends identifications or email verifications.

Set it up

With a sign-in screen (claude.ai, Claude Desktop, ChatGPT, Cursor, Claude Code): give the assistant the address above and nothing else. It sends you to Contaktly, you sign in, you see what it will be able to read and press Allow. The connection appears under Settings, Integrations, AI assistants, with who approved it and when it was last used. Disconnect it there the moment it should stop.

Without one (n8n, a script, an unattended machine): create a key on the same card, named after the tool. The key is shown once; paste it into the tool as a bearer token. Revoke it from the card when the tool should stop.

Connect your assistant

Where the address goes, per assistant. The sign-in happens in your browser the first time; after that the assistant keeps itself connected.

claude.ai and Claude Desktop

1. Settings, Connectors, Add custom connector
2. Name: Contaktly
3. URL: https://app.contaktly.com/api/mcp
4. Add, then Connect
5. Sign in to Contaktly and press Allow

The sign-in, for builders

The server is an OAuth 2.1 resource server and its own authorization server, as the Model Context Protocol specifies. A client that gets a 401 reads the protected resource metadata named in the WWW-Authenticate header, finds the authorization server, registers itself and sends the person to the consent page. No client needs to be set up on our side first.

Resource metadata: https://app.contaktly.com/.well-known/oauth-protected-resource
Server metadata: https://app.contaktly.com/.well-known/oauth-authorization-server
Registration: Dynamic (RFC 7591), no credential needed
PKCE: Required, S256 only
Scopes: read
Tokens: Access tokens last an hour; refresh tokens rotate on every use and expire after ninety idle days
Redirect addresses: https anywhere, http on localhost, or a private app scheme
Revocation: POST /api/oauth/revoke with the token

What a client reads first

GET https://app.contaktly.com/.well-known/oauth-protected-resource

{ "resource": "https://app.contaktly.com/api/mcp", "authorization_servers": ["https://app.contaktly.com"], ... }

The tools

`list_companies` List identified companies

The companies identified on the website in a date range, newest visit first, with intent, visits, time on site, top pages, how many people were found and whether the company matches the ideal customer profile.

range: 'last_24h' | 'last_7' | 'last_30' | 'last_90' | 'this_month' | 'last_month' | 'all' Default last_7.
intent: ('hot' | 'warm' | 'cool')[] Leave out for every intent.
in_profile: boolean true: only companies matching the saved profile.
search: string Part of a company name or domain.
limit: number Up to 100, default 25.
offset: number For the next page.

Returns companies[] with domain, name, intent, visits, timeOnSiteSeconds, lastVisit, pages, peopleCount, profile, industry, employees, location, linkedin; plus total.

`get_company` Get one company

Everything Contaktly knows about one company by domain: the company, its visit history and intent, the people found there with verified emails, LinkedIn profiles and any phone number already looked up, where it already lives in a connected CRM, and the link to open it in Contaktly.

domain: string As shown by list_companies, e.g. acme.com.

Returns company, visits, people[] (name, title, email, emailStatus, linkedin, phone), crm[] and link. An unknown domain is an error.

`get_profile` Get the ideal customer profile

The workspace's saved ideal customer profile: countries, industries and company sizes. Empty lists mean "any".

Returns set, countries[], industries[], sizes[].

`who_to_call` Who to call today, a prompt

A short call list from the hottest recent visits in the profile: the company, why now, and the person to call.

range Default last_7.

Questions to ask

Who visited our website this week from companies in our profile, and who should I call first?
Which companies looked at our pricing page in the last month?
What do we know about acme.com, and is it already in our CRM?
Give me the hot visits of the last 24 hours with a verified email, as a table.

Intent words mean what they mean in Contaktly: hot is a high-intent page such as pricing or contact on a real visit, or more than five minutes on the site; warm is a high-intent page on a bounce, a minute on the site, or a return visit; cool is the rest.

Security

A key or a sign-in opens one workspace and nothing else. Keys and tokens are stored as hashes; we cannot show them to you again.
The sign-in follows OAuth 2.1: PKCE on every request, single-use codes that live ten minutes, refresh tokens that rotate on every use. A rotated token presented again ends the whole connection, so a copied token is worth nothing for long.
The consent page shows who is asking and which workspace before anything is shared, and it cannot be shown inside another site.
Every tool is read-only and says so to the assistant, so a client that respects tool annotations never asks before reading.
Emails are returned only when verified. The server never guesses an address and tells the assistant not to either.
Nothing a visitor typed into your chat is returned through these tools, so text written by a stranger cannot instruct your assistant.
Revoking a key or disconnecting an assistant takes effect on the next request. Both show when they were last used, so an unused one is easy to spot.

Without a valid key or token

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="Contaktly", resource_metadata="https://app.contaktly.com/.well-known/oauth-protected-resource"