MCP Server Official

MCP for product management: the ProductLift MCP server

Connect Claude, Cursor, ChatGPT, and any MCP-compatible agent to your ProductLift portal. Read feedback, cast votes, update statuses, draft release notes, all through natural language.

Start free trial Install snippet
✓ OAuth 2.1 + PKCE ✓ JSON-RPC 2.0 ✓ Auto-discovery
claude_desktop_config.json
MCP-Server 
{
  "mcpServers": {
    "productlift": {
      "type": "http",
      "url": "https://your-portal.example.com/mcp"
    }
  }
}
Client discovers OAuth endpoints and tools automatically on first connect.

What is MCP

An open standard for connecting agents to your tools

The Model Context Protocol is an open specification, originally proposed by Anthropic, that lets AI agents talk to external tools and data through a shared JSON-RPC interface. Any compliant client, from Claude Desktop to Cursor, can connect to any compliant server.

ProductLift is a first-class MCP citizen, not a proprietary integration. Our server exposes the same actions our REST API does, but framed as tools the model can call directly. That means agents can read a board, prioritize a backlog, or ship an update without any custom glue code on your side.

Tool surface

What our MCP server exposes

Every tool is generated from our OpenAPI spec and carries a machine-readable description, so agents pick the right one without prompting tricks.

Posts

  • List, get, create, update, delete
  • Search across the portal
  • Find duplicates and merge
  • Toggle publish state

Comments

  • List comments on a post
  • Create, update, delete
  • Notify voters on reply

Votes

  • List votes on a post
  • Cast a vote (self or on-behalf)
  • Revoke a vote

Statuses, Categories, Tags, Boards

  • Full CRUD on each taxonomy
  • Reorder and rename
  • Reassign in bulk via posts_update

Users

  • List, get, create, update, delete
  • Find a user by email
  • Attribute posts and votes on-behalf

Sections (Knowledge Base)

  • List, create, update, delete
  • Reorder within a parent
  • Get children for tree traversal

Install · Claude Desktop

Add ProductLift to Claude Desktop

Three steps. The first connect triggers a one-time OAuth approval in your browser, then the token is stored locally.

claude_desktop_config.json 
{
  "mcpServers": {
    "productlift": {
      "type": "http",
      "url": "https://your-portal.example.com/mcp"
    }
  }
}
  1. 1

    Find your portal URL

    Your portal hostname is what your users already visit, for example acme.productlift.dev or your custom domain.

  2. 2

    Add the block to your config

    Open Claude Desktop settings, edit claude_desktop_config.json, paste the snippet, save.

  3. 3

    Approve OAuth on first connect

    Restart Claude Desktop. On first tool call, a browser tab opens on your portal to authorize the connection. Log in, approve the mcp scope, done.

Install · Other clients

Claude.ai, Cursor, and ChatGPT

Any MCP-compliant client works. The only thing that changes is where you paste the URL.

Claude.ai

  1. Open Settings → Connectors.
  2. Click Add custom connector.
  3. Paste https://your-portal.example.com/mcp.
  4. Click Connect and approve the OAuth flow.

Works in Claude for Work workspaces too.

Cursor

  1. Open Settings → MCP.
  2. Add a new server of type http.
  3. Set URL to https://your-portal.example.com/mcp.
  4. Save, then approve the OAuth prompt.

Tools appear in the Cursor chat picker.

ChatGPT

  1. Open Settings → Connectors (developer mode).
  2. Click Add custom connector.
  3. Paste https://your-portal.example.com/mcp.
  4. Approve the OAuth prompt when the first tool runs.

Zed and any other MCP-compliant client follow the same pattern.

Auth model

OAuth 2.1 with PKCE. No pre-created keys.

The server uses OAuth 2.1 with PKCE and Dynamic Client Registration (RFC 7591). Any compliant MCP client can register itself, open a browser for the portal admin to sign in, and receive a bearer token scoped to mcp. There are no long-lived API keys to mint, rotate, or leak into a config file.

Two discovery documents drive the flow, both served from your portal: /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource. Clients fetch them, register, redirect through /oauth/authorize, and then present Authorization: Bearer on every subsequent call. Actions are scoped to the ProductLift permissions of whoever approved the connection.

Example prompts

What a PM can do in Claude

Real prompts you can paste today. The caption shows which tools the agent picks up automatically.

"List all feature requests in my portal with 5+ votes."

Under the hood: posts_list with a votes filter.

"Create a new post titled 'API rate limiting' under Feature Requests."

Under the hood: categories_list then posts_create.

"Update post 123 to 'In Progress' and notify voters."

Under the hood: posts_update, notifications fire on status change.

"Search posts mentioning 'authentication' and rank the top 3."

Under the hood: posts_search, ranked in-model.

"Find and merge duplicates on 'export'."

Under the hood: posts_findDuplicates then posts_merge, votes preserved.

"Draft a KB article for the shipped feature 'CSV export'."

Under the hood: posts_get plus sections_create, model drafts the body.

Batch requests supported. JSON-RPC 2.0 batching lets an agent bundle multi-step workflows (list, filter, update, notify) into a single round trip. Useful for scripted maintenance and long agent loops.

Why official matters

The safe path for teams already experimenting

Community-built MCP servers for product tools already exist. That's proof teams want their agents to touch feedback and roadmap data. What a DIY wrapper cannot give you is per-user permission scoping, a full audit trail attributed to a real ProductLift identity, and tool schemas that update the moment we ship a new endpoint.

The official server runs inside the same request path as the portal UI, uses the same permission checks, writes to the same activity feed, and exposes the same OpenAPI surface. No separate token to rotate. No shadow copy of your data. When we add a new tool, every connected client sees it on the next tools/list refresh.

Security & audit

What the server guarantees

OAuth 2.1 with PKCE

Bearer tokens over HTTPS. PKCE prevents authorization-code interception. No client secrets sitting in local config files.

Per-user permission scoping

A member-level user's agent sees what a member sees. An admin's agent can do admin things. The role check is the same as the UI.

Full audit trail

Every action shows the same author, activity log, and notifications as if the user had clicked it themselves in the portal.

Revoke at any time

Remove the token from the OAuth clients list in your portal, or disconnect the client. No read-only-only mode yet, use client-side tool permissions for that.

Where MCP fits in the ProductLift loop

MCP is one of several ways agents plug into your product lifecycle. The rest of the AI story sits alongside it.

The full AI story

Prioritization, duplicate detection, KB drafting, and agent tooling in one view.

See the AI story

How ProductLift works

Feedback, roadmap, changelog, KB. The full loop from request to shipped update.

See the loop

FAQ

Common questions about the MCP server

What is MCP? +

MCP (Model Context Protocol) is an open standard originally proposed by Anthropic that lets AI agents connect to external tools and data sources through a shared JSON-RPC interface. ProductLift implements an MCP server so agents can work with your portal.

Is the MCP server the same as the ProductLift REST API? +

The MCP server is generated from the same OpenAPI spec that powers our REST API, so it covers the same surface area. The difference is transport and authentication: MCP uses JSON-RPC 2.0 over a single POST endpoint with OAuth 2.1, while the REST API uses conventional HTTP verbs with API keys.

Do I need to create an API key to use the MCP server? +

No. The MCP server uses OAuth 2.1 with PKCE and Dynamic Client Registration (RFC 7591). Any compliant client can register itself and prompt you to sign in with your normal ProductLift credentials. No pre-created API key is required.

Which MCP clients does the ProductLift server work with? +

Claude.ai custom connectors, Claude Desktop, Cursor, ChatGPT, Zed, and any other MCP-compatible client. The server exposes the standard OAuth discovery documents, so setup is the same across clients.

Can I limit which tools an agent uses? +

Yes. Most clients (Claude.ai, Claude Desktop) let you approve individual tools or require confirmation before certain actions run. Server-side, every action is also scoped to the ProductLift permissions of the user who approved the OAuth connection.

Is the MCP server secure? +

OAuth 2.1 with PKCE, bearer tokens over HTTPS, per-user permission scoping, and a full audit trail of every action. Tokens can be revoked from the portal or from the client at any time.

Does the MCP server work with Claude Sonnet and Claude Opus? +

Yes. MCP is model-independent. Any Claude model available in Claude.ai or Claude Desktop, including Sonnet and Opus, can use the ProductLift connector.

Can I use it in Claude for Work? +

Yes. Claude for Work supports custom connectors, so a workspace admin can add the ProductLift MCP URL and share it with team members.

Point your agent at ProductLift.

One URL. One OAuth approval. Every tool your PM workflow needs, callable from Claude.

Start free trial See the AI story
✓ Official MCP server ✓ OAuth 2.1 ✓ Free plan supported
We use cookies for analytics on productlift.dev. See our cookie policy.