Connect ChatGPT, Cursor and your own agents

The Convultra MCP server is in Beta. It accepts both OAuth access tokens and sk_ API keys, so hosted assistants sign the user in while terminal, editor and custom clients generally use a key. The URL is the same for everyone: https://mcp.convultra.com/mcp. For Claude, see Connect Claude.

Summary

ChatGPT

1. Open Settings → Connectors → Create.
2. Paste https://mcp.convultra.com/mcp.
3. Sign in on the Convultra consent screen, review the permission lines, and choose all projects or specific ones.

ChatGPT uses OAuth only. It will not accept an sk_ key, so there is nothing to paste beyond the URL. The flow is the same OAuth 2.1 discovery that Claude uses: ChatGPT fetches https://mcp.convultra.com/.well-known/oauth-protected-resource/mcp, finds the authorization server, and receives a cvt_ access token after you approve. To revoke, remove the connector in ChatGPT.

Cursor

Create a key under Settings → Developer with the read scopes you need, then add the server to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "convultra": {
      "url": "https://mcp.convultra.com/mcp",
      "headers": { "Authorization": "Bearer sk_your_key_here" }
    }
  }
}

Restart Cursor and the 21 Convultra tools appear. Because the key sits in a file on disk, give it an expiry (90 days is the default) and only the scopes the work needs. If the file is shared or committed by mistake, revoke the key from the Developer tab; it stops working immediately.

Your own agent

The server is a standard remote MCP endpoint over streamable HTTP. Send JSON-RPC by POST with a bearer key:

curl -s https://mcp.convultra.com/mcp \
  -X POST \
  -H "Authorization: Bearer sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Any MCP client library that supports streamable HTTP with a static header works. Points to know:

• Stateless. There is no session to establish. Each request stands alone.
• POST only. A GET returns 405.
• No credential in the URL. Query parameters named token, api_key, apiKey, access_token or key are refused with 400 invalid_request before authentication.
• A 401 carries WWW-Authenticate. If your client supports OAuth, that header is what triggers the sign-in flow. With a key, a 401 means the key is missing, malformed, revoked, expired, or is a proj_ tracking key rather than an sk_ key.
• Tool results are trimmed. Lists return the top 25 rows by default, 200 at most, with a note that more exist. Use the REST API at https://data.convultra.com/v1 when you need full pages.
• Rate and concurrency limits are the same as REST, and an agent that fans out several calls per question consumes them quickly. Honor Retry-After on a 429. See the API overview.

Which credential to use

Reading the answers correctly

Whatever the client, the same four rules apply: call get_tracking_health before interpreting a drop; conversion rate is over visitors except on breakdown rows; null is not zero; and AI referrals are humans already in every total while AI crawlers are in none. See The MCP server and Metric definitions.