Connect Gemini and other AI apps

Any MCP client that supports remote servers with OAuth can connect to https://api.evenbead.com/mcp the same way Claude and ChatGPT do: it discovers Evenbead's authorization server, registers itself, sends you to Evenbead's consent screen, and gets short-lived tokens for the MCP endpoint only.

Google Gemini

• Gemini app (custom MCP apps, web): Google's help article describes adding a custom MCP server in the Gemini web app for personal accounts in the US (18+, with Keep Activity on). Enter https://api.evenbead.com/mcp; Gemini registers itself and opens Evenbead's consent screen. Google does not document the redirect address it uses; Evenbead accepts the address Gemini registers and shows its host on the consent screen. Reports from developers in October 2026 describe some servers where Gemini never finishes the token step; if that happens, tell us at support@evenbead.com.
• Gemini Enterprise: an administrator creates a custom MCP server data store with a fixed authorization URL, token URL, client ID and secret (no automatic registration). Register a client first (below) with the redirect address Google lists (https://vertexaisearch.cloud.google.com/oauth-redirect) and "token_endpoint_auth_method": "client_secret_basic", then enter: authorization URL https://app.evenbead.com/oauth/authorize, token URL https://api.evenbead.com/oauth/token, and the client ID and secret Evenbead returned. Evenbead requires PKCE (S256) on every authorization; we have not confirmed that Gemini Enterprise sends it, and without it the consent screen sends an invalid_request error back.
• Gemini CLI: Google replaced Gemini CLI with Antigravity CLI for personal accounts in June 2026, and its MCP sign-in is not documented yet. Earlier Gemini CLI versions connect with httpUrl set to the MCP URL and discover OAuth on their own.

VS Code, Cursor, MCP Inspector and others

• VS Code: add an HTTP MCP server with the URL; VS Code registers itself (redirects to http://127.0.0.1:33418/ or https://vscode.dev/redirect).
• MCP Inspector: connect with the URL and use its OAuth flow; it returns to http://127.0.0.1:6274/oauth/callback.
• Cursor: Cursor registers a cursor:// address together with its local one. The MCP specification allows only https and local addresses for redirects, so Evenbead refuses that registration; connect Cursor with an agent's API key in a header instead (see MCP setup).
• Clients without OAuth: use an agent's API key as a Bearer token (see MCP setup).

A local address such as 127.0.0.1 may use any port: the consent screen says it sends you back to a program on your computer. Only continue if you started the connection there.

Register a client by hand

For a client that needs a fixed client ID, register one with dynamic client registration (RFC 7591):

curl -s https://api.evenbead.com/oauth/register -H 'content-type: application/json' -d '{
  "client_name": "Our assistant",
  "redirect_uris": ["https://assistant.example.com/oauth/callback"],
  "grant_types": ["authorization_code", "refresh_token"],
  "token_endpoint_auth_method": "client_secret_basic"
}'

The answer has client_id and, for client_secret_basic or client_secret_post, a client_secret shown once. Use "token_endpoint_auth_method": "none" for a public client (an app on a device). Registrations are limited per address, and registered clients that are never used are removed after seven days. A registered client shows as unverified on the consent screen.

Technical details

• A request to the MCP endpoint without a valid token gets 401 with WWW-Authenticate: Bearer resource_metadata="...", scope="read propose".
• Authorization responses carry iss (RFC 9207); errors about the client or its redirect address are shown to the person and never redirected.
• The implicit flow, the password grant, client credentials and plain PKCE are not supported.
• Revoke a token with POST /oauth/revoke (RFC 7009); revoking the refresh token ends the connection.
• Writes need no X-Agent-Model header from a connected app: the audit log records the app's registered name as the model unless the client sends one.
• An accounting firm's connection can reach several clients: each tool then takes a company_id argument (list them with list_firm_clients).