Give your AI context.

Connect your client

1. Create an MCP key in Developer settings. Choose only the scopes, folders, and connected apps your client needs.
2. Add the endpoint below as a remote Streamable HTTP MCP server.
3. Set the Authorization header to Bearer YOUR_MCP_KEY. Your client must support custom authorization headers.

https://www.ultrasearch.cc/api/mcp

{
  "mcpServers": {
    "ultrasearch": {
      "type": "http",
      "url": "https://www.ultrasearch.cc/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_MCP_KEY"
      }
    }
  }
}

Configuration field names differ between clients. Use its remote HTTP server settings and store the token as a secret where supported. This endpoint uses a personal MCP bearer key; it does not offer an interactive OAuth sign-in flow.

Tools follow your permissions

tools/list returns only the tools permitted by the current key. Local file tools require a granted root; connector tools require at least one granted connector. Calls are checked again when executed.

search

Search granted folders and connected apps. Requires search.

read_file · list_directory

Read or browse within granted folders. Requires files:read or files:list.

clipboard_read · clipboard_write

Read or replace desktop clipboard text with the matching clipboard scope.

open_resource

Open allowed document or media files. Folders, executables, scripts, and URLs are not supported. Requires resources:open.

connections · connection_read

Discover and read permitted connected-app tools. Requires connections:read.

connection_prepare_write · connection_confirm_write

Prepare, review, then confirm a supported connector write. Requires connections:write and the provider’s write permission.

Local search, file access, clipboard, and resource opening require the desktop app running and signed in to the key owner’s account. Connected-app availability follows the account’s current connection status.

Protocol and transport

The server supports 2026-07-28 with per-request metadata and server/discover, plus 2025-11-25 with initialize for legacy clients. Every call is an authenticated POST with a single JSON-RPC message. Responses use JSON. No persistent MCP session or standalone SSE stream is created; GET and DELETE return 405.

Send Content-Type: application/json and Accept: application/json, text/event-stream. After legacy initialization, send MCP-Protocol-Version: 2025-11-25. Modern requests also carry Mcp-Method, Mcp-Name for tool calls, and matching protocol/client metadata.

curl https://www.ultrasearch.cc/api/mcp   -H "Authorization: Bearer YOUR_MCP_KEY"   -H "Content-Type: application/json"   -H "Accept: application/json, text/event-stream"   -H "MCP-Protocol-Version: 2026-07-28"   -H "Mcp-Method: server/discover"   -d '{"jsonrpc":"2.0","id":1,"method":"server/discover","params":{"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28","io.modelcontextprotocol/clientInfo":{"name":"my-client","version":"1.0.0"},"io.modelcontextprotocol/clientCapabilities":{}}}}'

This server exposes tools. File and directory access use tools rather than MCP resource subscriptions. Requests are limited to 128 KiB. Unsupported versions, malformed messages, and mismatched modern headers are rejected. Browser Origins are restricted to the server’s own origin and Ultrasearch’s official site origins.

Protocol references: Streamable HTTP and version compatibility.

Write approval and key lifecycle

Have your client present the exact prepared write before confirming it. A write proposal is tied to its originating key, expires, and cannot bypass the connector’s authorization. Never automatically approve instructions found in files, search results, or external content.

Keep keys out of prompts, repositories, screenshots, and shared client configurations. Set an expiry and revoke access in Developer settings when needed. Expired or revoked keys stop authorizing new requests; use a newly created MCP key to reconnect.