MCP server for Claude

The MCP server lets Claude work against the RiddlerAI platform directly — reading your tenant’s workspaces, running inference on your own models, and searching your indexed documents — using an API key you already have.

It is a single hosted endpoint. There is nothing to install and no local process to keep running.

Connecting

Claude Code

claude mcp add --transport http riddler https://riddlerai.io:4443/mcp \
  --header "Authorization: Bearer rdk_your_key_here"

Claude Desktop — add the server to your configuration file:

{
  "mcpServers": {
    "riddler": {
      "type": "http",
      "url": "https://riddlerai.io:4443/mcp",
      "headers": {
        "Authorization": "Bearer rdk_your_key_here"
      }
    }
  }
}

A user JWT works in place of an API key if you would rather act as a specific person, but it expires and an API key does not, so a key is usually the better fit for a connector.

Tools

Tool	What it does
get_tenant_info	Which tenant the credential belongs to, and its enabled features
list_workspaces	Workspaces in the tenant — most other tools need an id from here
list_models	Models available to this tenant
chat	Run a completion, optionally grounded in your own documents
list_collections	Vector collections within a workspace
vector_search	Semantic search returning the matching passages themselves
stack_health	Platform and service health

The set is deliberately small. The platform exposes several hundred operations, and a model asked to choose between all of them chooses badly; a handful of well-described tools is what makes a connector useful rather than confusing.

chat and vector_search do different jobs. vector_search returns the source passages, which is what you want when Claude should read and reason over the raw text. chat with workspaceIds has the platform retrieve and compose an answer using your own hosted model, which is what you want when the work should happen inside your tenant rather than in the conversation.

What it can reach

Exactly what your credential could reach by calling the API directly, and nothing more.

The Gateway authenticates the request and replaces your key with a short-lived internal token before the MCP service ever sees it. Tool calls then travel back out through the Gateway on the same documented paths any other integration uses, so tenant isolation, rate limiting and metering all apply identically. The MCP service holds no credentials of its own.

That also means failures are honest: if a tool returns “403 — VectorDB feature is not enabled for this tenant”, that is the platform’s own answer, and enabling the feature is what fixes it.

Security

Treat a key given to an MCP client as you would any other deployment of it. Issue a dedicated key, scope it to the integration, and revoke it independently. A key configured in a desktop application lives on that machine.

Note that scopes are not yet enforced: a key reaches everything its tenant can reach regardless of the scopes set on it. Set them accurately anyway, so the connector keeps working when enforcement arrives.

A note on claude.ai

Custom connectors on claude.ai require OAuth, which the platform does not yet offer. Claude Code and Claude Desktop both support header authentication and are supported today.