Francolabs MCP Server

FrancoLabs MCP Server

Connect AI assistants to FrancoLabs — a UX research platform — over the Model Context Protocol. Let Claude, ChatGPT and other MCP clients create and manage studies, browse templates, read participant responses and analytics, run AI-grounded analysis, and turn insights into product opportunities on your behalf.

• Endpoint: https://francolabs.vercel.app/mcp
• Transport: Streamable HTTP (MCP protocol 2025-06-18)
• Auth: OAuth 2.1 (Dynamic Client Registration + PKCE) or Personal Access Token
• Registry: io.github.glauberfrancodesign/francolabs

---

Connect

Claude (claude.ai / Desktop)

Settings → Connectors → Add custom connector → URL:

https://francolabs.vercel.app/mcp

Complete the OAuth consent screen — you choose exactly which scopes to grant and can toggle read-only access.

ChatGPT

Enable Developer Mode, then Settings → Connectors → Add → same URL. Authenticate via the OAuth flow.

Claude Code / Cursor (manual token)

Generate a Personal Access Token in Settings → Integrations, then:

claude mcp add --transport http francolabs \
  "https://francolabs.vercel.app/mcp" \
  --header "Authorization: Bearer <your-token>"

---

Tools

A tool listed with two scopes needs both. AI marks tools that call a language model and use AI credits; the model only sees the deterministic digest and curated insights, with e-mail addresses and phone numbers masked first.

Templates, workspaces and projects

Studies

Responses, analysis and insights

Opportunities and decisions

Contacts (personal data)

create_project and create_study write into a workspace — pass workspaceId (see list_workspaces), or omit it to use your oldest workspace by default. Write tools also require an editor role (owner, admin or member) in the study's workspace; viewers can only read.

Two resources are also exposed: francolabs://templates and francolabs://question-types.

Scopes

templates:read · projects:read · projects:write · studies:read · studies:write · responses:read · contacts:read · contacts:write

contacts:read and contacts:write give access to personal data of your respondents (e-mail, name, locale/country, research consent, tags and response history). They are opt-in: the consent screen and the Read-only token preset leave them unchecked; grant them only to assistants that need your contacts base. responses:read returns raw answers, which can also contain personal data typed by respondents.

Tools you didn't grant are hidden from tools/list. A read-only grant blocks every write tool server-side, regardless of scopes.

Security

• Tokens are stored only as SHA-256 hashes — never in plaintext.
• Each request mints a short-lived (5 min) JWT so all data access runs under per-user row-level security; the service role is used only for the token lookup.
• OAuth access and refresh tokens last 30 days; a connection never outlives 90 days. Access is revocable anytime from Settings → Integrations, and clients can revoke a token at the revocation endpoint (RFC 7009).
• OAuth follows RFC 9728 (protected-resource discovery), RFC 8414 (AS metadata), RFC 7591 (dynamic client registration) and PKCE S256.

Source

This repository mirrors the server's source for transparency. The server runs as a Supabase Edge Function (src/mcp, src/mcp-oauth, src/_shared).

---

© FrancoLabs. All rights reserved.