MCP — install & tool reference

I'mBoard ships an MCP (Model Context Protocol) server that wraps the I'mBoard REST API and gives any MCP-aware AI client — Claude Code, Claude Desktop, Cursor, Cline, and others — direct access to your boards, meetings, documents, reports, dashboards, ontology, and knowledge graph through natural language.

This page is install + reference. Each section is independent — jump to your client of choice and copy the snippet, then come back for the tool catalog and workflow examples.

API vs CLI vs MCP

All three speak to the same API using the same personal access token (the hosted connector below mints a scoped one for you when you sign in).

Fastest: claude.ai on the web — no install, no token

I'mBoard runs this same server as a hosted remote endpoint (streamable HTTP, signed in with OAuth).

1. In claude.ai, open Settings → Connectors → Add custom connector.
2. Paste the URL https://app.imboard.ai/mcp (also shown with a Copy button under Account → API Access in I'mBoard). Keep the detected options Sign in now and Register automatically.
3. Sign in to I'mBoard when asked, and choose Full access or Read only. Access always respects your board permissions.

The connection appears under Account → API Access as "Claude (MCP connector)". Revoke it there at any time; that disconnects it immediately.

Other clients that support remote MCP servers can use the same URL. In Claude Code, for example:

claude mcp add --transport http imboard https://app.imboard.ai/mcp

The rest of this page covers the local (stdio) install, which uses an API token you create yourself.

1. Get a token

The local (stdio) MCP server authenticates with an I'mBoard API token. There are two kinds, and which one you pick changes what the agent can reach:

Rule of thumb: if the agent only needs one board and should not be able to touch anything else, use a BAT. If you want an agent that acts as you across all your boards, use a PAT. See Board tokens vs personal tokens below for the full comparison and the downstream proof.

Personal access token (PAT)

1. Open I'mBoard and navigate to Account → API Access.
2. Click Create Token.
3. Name it after the client (e.g. claude-desktop, cursor) so you can revoke per-client later, and choose the shortest expiry that fits your use case.
4. Copy the token immediately — it starts with imb_pat_ and is only shown once.

Board access token (BAT)

A BAT is minted from the board's own settings (not your account), so its lifecycle belongs to the board rather than to you. It is pinned to that one board, carries the Board read only scope preset by default, and has no access to your profile, your other boards, or portfolio data.

1. Open the board and go to Board settings → Access tokens. (Only board owners and admins can create tokens; other members see the list read-only.)
2. Click Create board access token and name it after the agent (e.g. acme-reporting-bot).
3. Choose a scope preset — Read only (default) or Read & write (read + write this board; never create/delete boards) — and an expiry.
4. Copy the imb_bat_… token immediately — like a PAT, it is only shown once.

Use it anywhere this guide says IMBOARD_API_TOKEN (see the snippets below — just swap the imb_pat_ value for your imb_bat_ value). For the full BAT vs PAT contract, scoping rules, and minting walkthrough, see Authentication → Board Access Tokens.

2. Install per client

Pick your client. Every snippet below uses the same npm package (@imboard.ai/mcp-server) over stdio transport — for claude.ai on the web, use the hosted URL instead. The only thing that changes between clients is where you paste the config.

Claude Code

Add to your project's .mcp.json (or to ~/.claude/settings.json under mcpServers for global access):

{
  "mcpServers": {
    "imboard": {
      "command": "npx",
      "args": ["-y", "@imboard.ai/mcp-server"],
      "env": {
        "IMBOARD_API_BASE_URL": "https://app.imboard.ai",
        "IMBOARD_API_TOKEN": "imb_pat_YOUR_TOKEN"
      }
    }
  }
}

Restart Claude Code (or reload MCP servers). Verify:

"List my I'mBoard boards."

Claude should call list_boards and return your boards.

Claude Desktop

Edit claude_desktop_config.json (location: Settings → Developer → Edit Config, or ~/Library/Application Support/Claude/claude_desktop_config.json on macOS, %APPDATA%\Claude\claude_desktop_config.json on Windows):

{
  "mcpServers": {
    "imboard": {
      "command": "npx",
      "args": ["-y", "@imboard.ai/mcp-server"],
      "env": {
        "IMBOARD_API_BASE_URL": "https://app.imboard.ai",
        "IMBOARD_API_TOKEN": "imb_pat_YOUR_TOKEN"
      }
    }
  }
}

Fully quit Claude Desktop (Cmd-Q on macOS — closing the window is not enough) and relaunch. Verify by typing in any chat:

"List my I'mBoard boards."

The hammer icon at the bottom of the input should show imboard as an available server.

Cursor

Create .cursor/mcp.json in your project root (or ~/.cursor/mcp.json for global access):

{
  "mcpServers": {
    "imboard": {
      "command": "npx",
      "args": ["-y", "@imboard.ai/mcp-server"],
      "env": {
        "IMBOARD_API_BASE_URL": "https://app.imboard.ai",
        "IMBOARD_API_TOKEN": "imb_pat_YOUR_TOKEN"
      }
    }
  }
}

Open Settings → MCP in Cursor to confirm imboard is listed and toggled on. Verify in the Composer or chat panel:

"List my I'mBoard boards."

Cline (VS Code extension)

Open the Cline extension's MCP settings (click the server icon in the Cline sidebar, then Edit MCP Servers) and add:

{
  "mcpServers": {
    "imboard": {
      "command": "npx",
      "args": ["-y", "@imboard.ai/mcp-server"],
      "env": {
        "IMBOARD_API_BASE_URL": "https://app.imboard.ai",
        "IMBOARD_API_TOKEN": "imb_pat_YOUR_TOKEN"
      },
      "disabled": false,
      "autoApprove": []
    }
  }
}

Cline reloads MCP servers automatically. Verify with the same prompt:

"List my I'mBoard boards."

Continue, Goose, and other clients

Continue (~/.continue/config.json) and Goose (~/.config/goose/config.yaml) both support MCP servers with the same shape — command, args, env. Use the Claude Desktop snippet above as a template and adapt to the client's config syntax.

These configurations are community-contributed and not currently verified end-to-end by the I'mBoard team. If a snippet doesn't work for your client, please file an issue with the client name and version.

ChatGPT Apps

Coming soon — pending GA of the ChatGPT Apps platform for third-party MCP servers.

3. Auto-discovery via .well-known/mcp.json

For MCP-aware clients and directories (Smithery, the Anthropic MCP directory, etc.) that support auto-configuration, I'mBoard publishes a discovery manifest at a stable, unauthenticated URL:

curl https://app.imboard.ai/.well-known/mcp.json | jq .

The manifest follows the RFC 8615 .well-known/ URI convention and lists:

• name, displayName, description, version — server identity
• transport — install command (npx -y @imboard.ai/mcp-server) and the env vars the client must set (IMBOARD_API_BASE_URL, IMBOARD_API_TOKEN)
• remote — the hosted endpoint (type: streamable-http, url: https://app.imboard.ai/mcp) and its OAuth discovery URLs (auth.protected_resource_metadata, auth.authorization_server_metadata); omitted while the hosted endpoint is switched off
• tools — the full live catalog of MCP tools (auto-generated from the same route registry as the section below — never hand-maintained)
• links — deep links to install pages for common clients and to this documentation

Clients that consume .well-known/mcp.json can configure the I'mBoard server without users editing JSON by hand. The manifest is cached by the CDN (5 min browser, 15 min edge) and refreshes on every deploy.

Board tokens (BAT) vs personal tokens (PAT)

The MCP server forwards your IMBOARD_API_TOKEN to the API as a bearer token and is completely token-type-blind — it never inspects the imb_pat_ / imb_bat_ prefix. That means a board access token works through every read tool that admits board tokens with no configuration change beyond the token value itself; tools that act as a user — e.g. get_board_context and the meeting-document tools such as list_meeting_documents — answer FORBIDDEN to one. Choosing the right token is purely a permissions decision:

When to use a BAT:

• A read-only reporting or analytics agent that should only ever see one board.
• A shared assistant that several board members use, where you do not want it acting as any one person.
• A CI job or automation that prepares one board's pack and must be incapable of touching anything else.

When to use a PAT:

• A personal agent that should roam across all the boards you belong to.
• Any workflow that needs your profile, your notifications across boards, or portfolio-level aggregation.

A BAT is read-only by default and board-scoped at the auth layer. Even if a tool that writes (or a tool on a different board) is invoked, the API rejects it — a write tool returns FORBIDDEN, and a tool aimed at any board other than the token's board returns not-found. You cannot accidentally over-grant a BAT by pointing an agent at the wrong tool.

Configure the MCP server with a BAT

Identical to any client snippet above — only the token value changes:

{
  "mcpServers": {
    "imboard-acme-board": {
      "command": "npx",
      "args": ["-y", "@imboard.ai/mcp-server"],
      "env": {
        "IMBOARD_API_BASE_URL": "https://app.imboard.ai",
        "IMBOARD_API_TOKEN": "imb_bat_YOUR_BOARD_TOKEN"
      }
    }
  }
}

Name the server after the board (e.g. imboard-acme-board) so it's obvious in the client which board the agent is scoped to.

Downstream proof — verify a BAT is board-scoped

This is a repeatable check that the board token does what it claims: it reads its own board and is blind to every other one. Run it after minting a BAT (use a disposable token and revoke it afterward).

1. Find two board IDs — the board your BAT is minted on (OWN_BOARD_ID) and any other board ID (OTHER_BOARD_ID). With a PAT you can list them: curl https://app.imboard.ai/api/v1/boards -H "Authorization: Bearer $YOUR_PAT" | jq '.data[].id'.

2. Export the disposable BAT:

   export BAT="imb_bat_YOUR_BOARD_TOKEN"

   Confirm what the token is before you go further — whoami echoes the board it is pinned to:

   curl -s https://app.imboard.ai/api/v1/whoami -H "Authorization: Bearer $BAT" | jq '{authType, boardId, boardName}'
   # → { "authType": "board_token", "boardId": "OWN_BOARD_ID", "boardName": "Acme Inc." }

3. Read the token's own board — expect 200 with data:

   curl -s -o /dev/null -w '%{http_code}\n' \
     https://app.imboard.ai/api/v1/boards/OWN_BOARD_ID/meetings \
     -H "Authorization: Bearer $BAT"
   # → 200

4. Read a different board with the same token — expect 404 (not-found, not 403):

   curl -s -o /dev/null -w '%{http_code}\n' \
     https://app.imboard.ai/api/v1/boards/OTHER_BOARD_ID/meetings \
     -H "Authorization: Bearer $BAT"
   # → 404  (board existence is deliberately not leaked)

5. In the MCP client itself, configure the server with the BAT (snippet above) and ask:

   "List the meetings for board OWN_BOARD_ID."

   The agent calls list_board_meetings and returns the meetings. Then ask it to list meetings for OTHER_BOARD_ID — it gets a not-found error and cannot see that board.

6. Revoke the disposable token when you're done.

If step 4 returns 200 instead of 404, the token is not board-scoped — stop and report it. The MCP server requires no code change for any of this: it forwards the bearer token and surfaces the API's response unchanged. (This contract is locked by an automated test in the MCP server package: tests/api-client/bat-downstream-proof.test.ts.)

Tool reference

The I'mBoard MCP server exposes every API endpoint flagged for AI consumption. Tools are organized by domain. Each row shows the tool name, the HTTP verb + path on the underlying REST API, and the API token scope required when authenticating with a personal access token (JWT sessions bypass scope checks).

Auto-generated from the route registry at build time. 153 tools across 32 domains.

Action Items

Agent Chat

Audit Log

Board Context

Board Cycles

Board Pack

Board Schemas

Board User Unregistered

Boards

Documents

FX

Invites

KG

KG Advisory

Me

Meeting Creation Suggestions

Meeting Minutes Items

Meetings

Members

Merge Recommendations

Notifications

Organizational Functions

Orgs

Persona Dossiers

Portfolio

Reports

Rogue Kpis

Schema Onboarding

Section Submissions

Slots

Unassigned Attachments

User

Advisories

• get_governance_advisories takes reportId (list only the findings about one report) and includeCounts (true adds counts next to the list: per status, per rule type, the highest open severity and the last review). On a kpi_consistency finding, payload.fields[].value is the value at detection time, not the live value; other rule types carry no fields.
• get_org_portfolio returns advisory counts only per board, plus viewerCanViewAdvisories on each board ref. Read the findings per board with get_governance_advisories.
• A board access token (BAT) cannot read advisories: the advisory endpoints return 403 for it. Use a personal access token whose owner is in the board's advisory audience (default CEO, CFO, Chief of Staff).
• Findings about a draft or archived report follow that report's visibility: only a board admin or an internal-management member gets them. Anyone else in the audience also loses the findings about a deleted report. For them, get_governance_advisories (list and counts) and get_board_prep_brief leave these findings out. Two counts still include them: the get_org_portfolio advisory counts, and each run's per-rule finding counts in get_governance_advisory_runs. Either can be higher than what that person can list.

Example workflows

The MCP server's job is to make agents useful — not to make every API endpoint visible. Three patterns that show up in real chair / CEO / VP-Finance work:

1. Prep the next monthly board package

"For board def456, compile next month's board package: collect the latest dashboard snapshots, list any open commitments still unresolved from last cycle, and surface the top three KPI variances vs. plan. Draft a one-paragraph cover note for the chair."

Behind the scenes the agent typically chains: list_board_cycles → get_board_cycle → compile_board_package → list_commitments → get_dashboard for each dashboard referenced → freeform narrative drafting.

2. Draft an investor update from recent KPI changes

"Look at board def456's last two cycle snapshots. Find KPIs that moved more than 15% in either direction. Group by domain. Write a four-paragraph investor update — opening hook, growth highlights, the one number we missed and why, and what we're focused on next month."

Common chain: list_board_cycles → two get_cycle_progress calls → list_board_documents for context → narrative drafting.

3. Audit commitments before the meeting

"Show me every commitment on board def456 that's overdue or due in the next seven days. Group by owner. For each owner, surface the most recent status update and the original target date. Highlight anyone with three or more overdue items."

Common chain: list_commitments with date filtering → get_board_member for each owner.

Troubleshooting

Security notes

• Never commit tokens to source control. Use .env files excluded from git, or your OS keychain. Cursor and Cline both support per-workspace env files; Claude Desktop and Claude Code accept env inline in the config — those config files should themselves be outside any tracked repo.
• Use short-lived, narrowly-scoped tokens. Create one token per tool so you can revoke them independently when a laptop is lost or a contract ends.
• Audit access regularly. The same Account → API Access page lists every active token with last-used timestamps.