Use naulon from Claude and ChatGPT

You can connect your naulon account to an AI app that speaks MCP, such as Claude, Claude Code or ChatGPT. The app sends you to naulon.app, you sign in, see what it is asking for, and approve. The app never sees your password.

Connect an app

Add this address to the app as a remote MCP server (a custom connector in Claude, a connector in ChatGPT's developer mode):

https://gate.naulon.app/_naulon/mcp/account

In Claude Code:

claude mcp add --transport http naulon-account https://gate.naulon.app/_naulon/mcp/account

The first time the app uses it, your browser opens naulon.app. Sign in if you are not already, check the request, and choose Allow.

What the app can do

For now the connection has one tool, naulon_whoami. It tells the app which naulon account it is connected to, the organizations you work in and your role in each, and the sites that role reaches. It only reads. More tools will follow, and each one will say what it does before you allow it.

What you approve

The approval screen shows you:

• The app, and whether naulon recognises it. An app naulon cannot confirm is shown as "an unverified app", with the name it gave quoted underneath. Approve it only if you know where it came from.
• The account it will act for: the one you are signed in as.
• Where naulon sends you back after you approve. If an app only returns to your own computer, the screen says so: approve it only if you started that app yourself.
• What it will be able to do. Reading your account is part of every connection. Today that is all a connection can do. When tools that change settings arrive, changing prices and crawler rules will be a separate box that starts unticked. Payouts, wallets and your team are never reachable.

If your account has a second factor, you confirm with it before an app is allowed. If you signed in more than twelve hours ago, naulon asks you to sign in again first.

Ending a connection

Every connection is listed in Connected apps, with what it may do and when it was last used. Disconnect signs the app out at once: its next request is refused. A connection ends by itself after 90 days unless you approve the app again.

naulon emails you whenever an app is connected to your account. If an app ever presents a sign-in token that was already used, which happens when a token has been copied, naulon ends that connection straight away and emails you about it.

For developers

The account server is a standard OAuth 2.1 protected resource:

• Authorization server metadata: https://naulon.app/.well-known/oauth-authorization-server
• Protected resource metadata: https://gate.naulon.app/.well-known/oauth-protected-resource/_naulon/mcp/account
• PKCE with S256 is required. Clients identify themselves with a client ID metadata document (an HTTPS URL as client_id) or register through dynamic client registration.
• Send resource=https://gate.naulon.app/_naulon/mcp/account when you authorize. A token works only at the resource it was issued for.
• Scopes are account:read and offline_access; account:write is added with the first tool that writes. Access tokens last an hour. Refresh tokens are replaced on every use, and presenting a replaced one ends the connection.
• A call without a usable token gets 401 with a WWW-Authenticate header pointing at the metadata. A call to a tool that needs a scope the connection lacks gets 403 with error="insufficient_scope" and the scope to ask for.