https://mcp.rewind.rest/mcp. Use it when your client cannot launch a local process: Claude on iOS, claude.ai, ChatGPT, and other clients that connect to a remote URL. If you are on a desktop that can run a child process, connect over local stdio instead.
The MCP endpoint is https://mcp.rewind.rest/mcp. Connect with an OAuth-capable client and complete GitHub sign-in. A Rewind REST API key (rw_...) cannot authenticate directly to this endpoint; use it with the local stdio server instead.
Connect with GitHub sign-in
Clients that implement the full OAuth 2.1 handshake (claude.ai and Claude on iOS, for example) do not ask you for an API key. You add the server by URL, and the client redirects you through a consent flow. The Worker uses GitHub as the upstream identity provider and checks your GitHub account against its access allowlist. The hosted Worker reads the archive configured by its server-side Rewind API key.Add the server by URL
In your client’s integrations or connectors settings, add a remote MCP
server with the URL
https://mcp.rewind.rest/mcp. Leave the authorization
field blank if the client offers one; the OAuth flow supplies the token.Approve the consent screen
The client opens the Rewind authorize page. It names the client requesting
access and the scopes it is asking for. Review it, then choose to sign in
with GitHub.
Authenticate with GitHub
GitHub prompts you to authorize the connection. After you approve, GitHub
redirects back to the Worker, which looks up your GitHub account against the
Rewind allowlist.
The allowlist
Rewind is a single-user personal archive, so the hosted server does not grant access to anyone with a GitHub account. The Worker keeps an allowlist that associates allowed GitHub user IDs with Rewind user IDs. If your GitHub account is not on it, the callback fails with a403 and a message naming your GitHub login and ID, telling you to contact the Rewind admin to request access. To get added, send the admin the GitHub login and numeric user ID shown in that error.
See troubleshooting for how to resolve a
403 and other connection errors.Scopes
The server advertises the following read scopes. These names do not provide per-domain tool isolation in the current implementation; an authorized connection exposes the read-only tool set for the configured archive:
Every scope is read-only. The server exposes no write or admin tools regardless of which scopes a client requests.
Token lifetimes
Once authorized, your client holds two tokens and refreshes the short-lived one as needed:
When the access token expires, the client exchanges the refresh token for a new one without prompting you. You re-run the GitHub sign-in only after the refresh token lapses or if access is revoked.
The flow uses PKCE with S256 only. Plain PKCE is rejected, per the MCP specification, so a compliant client handles this automatically.
Rate limit
The hosted server caps requests at 120 per minute per client IP address. Exceed it and the server responds with429 Too Many Requests and a Retry-After: 60 header. Back off for a minute and the window resets. Normal interactive use stays well under this ceiling; you mostly hit it with tight automated loops.