Skip to main content
Summation hosts a Model Context Protocol (MCP) server so agents you already use can work with your data directly, without you moving between tools. It exposes your workspace to any MCP-capable agent, including Claude, Codex, or anything that speaks streamable HTTP:

​
What it exposes

The server exposes a curated set of non-destructive tools over the public API:
  • Analyst: ask data questions in natural language (ask_analyst), with multi-turn follow-ups
  • Catalog: search and describe tables, views, connections, and lineage; preview data
  • Query: bounded, read-only SQL execution
  • Reports: generate, validate, and export reports
  • Files: upload, download, and import files to tables
  • Playbooks & schedules: list, create, pause, resume, and trigger recurring runs
Tools that send email, such as schedule creation, say so in their tool definition, so agents confirm recipients first. The server is stateless, with no session affinity required. The toolset is a deliberately curated subset of the public API. Destructive operations such as deletes and connection management are excluded by design, and the set is re-curated as the API evolves. For the full contract, use sumcli or the Public API.

​
Authentication

People sign in with a browser. The server speaks standard MCP OAuth: register it with no headers, and your client opens a browser approval on first use. Machines use a bearer token in the Authorization header instead.
Easiest path: the Claude plugin and Codex plugin ship this server pre-wired. Install the plugin and approve once in the browser.

​
Claude Code

No --header and no token. Run /mcp, or any Summation tool, and Claude opens the browser approval.

​
Codex

​
claude.ai and Claude Desktop

Add the server URL as a custom connector; the one-click OAuth approval handles the rest.

​
Machines (automation)

Any client that supports streamable HTTP with a custom Authorization header works. Ask your Summation admin for M2M credentials, exchange them for an access token via the Public API, and send it as a bearer. For scripted work, prefer sumcli with an M2M profile; it manages the exchange for you.

​
Discovery metadata

The server returns the standard 401 challenge and advertises resource metadata at:
Clients that implement the MCP authorization spec discover the authorization server from there, with no manual configuration.
Never paste a personal bearer token into client config. Headerless registration plus browser approval is the supported path for people. Stored Authorization headers fight the OAuth flow and go stale.

​
Scopes

Tokens carry scopes that gate tool access. A valid token without the required scope gets a 403 naming the missing scope. See Authentication for the operations each scope covers.

​
Behavior notes

  • Long-running tools return one buffered result. Analyst questions, report generation, and validation take roughly 15 to 60 seconds and arrive as a single response. Set client tool timeouts to at least 120 seconds.
  • Auth errors mean an expired or revoked credential. Mint a fresh one and update the header.
  • Include the request_id from any error when contacting support; it joins your client-side failure to server-side traces.