# orbitreach MCP server

orbitreach exposes a stateless Streamable HTTP MCP server at
`https://orbitreach.io/api/mcp`. It uses the same workspace API keys as the REST API.
Create a key in **Settings → MCP** and send it as an
`Authorization: Bearer orb_...` header.

## Codex

Set `ORBITREACH_API_KEY` in your environment and add this to
`~/.codex/config.toml` (or `.codex/config.toml` in a trusted project):

```toml
[mcp_servers.orbitreach]
url = "https://orbitreach.io/api/mcp"
bearer_token_env_var = "ORBITREACH_API_KEY"
default_tools_approval_mode = "writes"
```

For the Codex desktop app, which may not inherit shell environment variables,
you can instead use a static authorization header:

```toml
[mcp_servers.orbitreach]
url = "https://orbitreach.io/api/mcp"
http_headers = { "Authorization" = "Bearer orb_your_api_key" }
default_tools_approval_mode = "writes"
```

`bearer_token` is not a supported Codex Streamable HTTP setting. Use
`bearer_token_env_var`, `http_headers`, or `env_http_headers`.

Restart Codex, then use `/mcp` or the MCP settings screen to confirm the
tools are available.

## Claude Code

Set `ORBITREACH_API_KEY` and add `.mcp.json` to the project:

```json
{
  "mcpServers": {
    "orbitreach": {
      "type": "http",
      "url": "https://orbitreach.io/api/mcp",
      "headers": {
        "Authorization": "Bearer ${ORBITREACH_API_KEY}"
      }
    }
  }
}
```

Run `/mcp` in Claude Code to inspect the connection.

## Safety

MCP keys inherit access to their orbitreach workspace and can be revoked in
**Settings → API**. The server exposes only shared workspace mailboxes.
`send_email` and `start_campaign` require an explicit confirmation input,
and clients should prompt before write tools. Keep keys out of source control.

## More

- [REST API guide](https://orbitreach.io/docs/api.md)
- [Developer portal](https://orbitreach.io/developers)