Anthropic

Point the Claude Console at Cakewalk's MCP Gateway with the MCP connector in the Messages API.

The Claude Console at platform.claude.com is Anthropic's developer surface: API keys, usage and the Messages API. Code you write there reaches Cakewalk through the MCP connector, a request parameter that points a Claude API call at a remote MCP server. There is no connector screen to fill in. The Gateway URL travels in the request body.

Setting Claude up for chat rather than code? Connect Claude to Cakewalk covers claude.ai, Claude Desktop and Cowork. For the terminal, see Connect Claude Code to Cakewalk.

Requirements

• A Claude Console account and an API key.
• The MCP connector is in beta. Every request carries the beta header mcp-client-2025-11-20.
• Supported on the Claude API, Claude Platform on AWS and Microsoft Foundry. Not supported on Amazon Bedrock or Google Cloud.
• You run the OAuth flow and refresh the resulting access token yourself. The Messages API does not run it for you.
• Anthropic does not cover the MCP connector under zero data retention arrangements.

Install Method

API parameter. The MCP Gateway is declared per request in the mcp_servers array, never saved in a settings screen. The connection to the Gateway originates from Anthropic's servers, so your own code never carries the tool traffic.

Authentication is OAuth 2.1, the same as every other Agent Platform. What differs is who runs it. Claude, Claude Code and Cursor open the sign in flow for you and hold the credentials. The Messages API does not. Your code runs the flow once, then sends the access token it returns on every request.

Step 1: Create an API key

1. Open https://platform.claude.com/settings/keys. The old console.anthropic.com address redirects here.
2. Create a key and store it as ANTHROPIC_API_KEY.

Step 2: Sign in to Cakewalk and get an access token

Nothing in the Cakewalk app hands you a token. There is no API key page and no personal token to copy. The Gateway accepts OAuth 2.1 only: authorization code with PKCE, plus Dynamic Client Registration, so a client registers itself rather than waiting on an Admin. The token comes out of that flow, and there are two ways to run it.

Option A: Run the flow from your code (production)

This is the path for anything that runs more than once. Any MCP client library implements the whole flow already, so point it at the Gateway and let it handle registration, sign in and refresh. If you are wiring it up yourself, the Gateway publishes everything you need:

Value	Where to get it
Protected resource metadata	https://mcp-gateway.getcakewalk.io/.well-known/oauth-protected-resource
Authorization server metadata	https://mcp-gateway.getcakewalk.io/.well-known/oauth-authorization-server
Client registration	POST https://mcp-gateway.getcakewalk.io/dcr
Scopes	openid, profile, email, offline_access

Register a client with your own redirect URI, send the employee through the authorization endpoint with PKCE, exchange the code for tokens, then store them. Ask for offline_access so you get a refresh token.

Option B: Mint one by hand with the MCP inspector (testing)

Use this to try a request or debug. It is Anthropic's recommended path and it produces the same kind of token:

1. Run npx @modelcontextprotocol/inspector in your terminal. Node.js is required.
2. Set Transport type to Streamable HTTP.
3. Enter the Gateway URL:

   https://mcp-gateway.getcakewalk.io/mcp

4. Click Open Auth Settings, then Quick OAuth Flow.
5. Sign in with your Cakewalk account and approve the Connection.
6. Step through OAuth Flow Progress until Authentication complete, then copy the access_token value.

The access token carries the identity of whoever signed in. Every call made with it is recorded in Cakewalk against that person, and every Policy that applies to them applies to it. Store it like a password and keep it out of source control.

Access tokens last 8 hours. A refresh token from offline_access is good for 30 days and extends each time you use it. A token pasted in by hand stops working the same day, which is why Option A is the real answer for anything you ship.

Step 3: Pass the Gateway in your request

Declare the server in mcp_servers and enable its tools with an mcp_toolset entry in tools:

curl https://api.anthropic.com/v1/messages \
  -H "content-type: application/json" \
  -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "anthropic-beta: mcp-client-2025-11-20" \
  -d '{
    "model": "claude-opus-5",
    "max_tokens": 1000,
    "messages": [{"role": "user", "content": "What tools do you have available?"}],
    "mcp_servers": [
      {
        "type": "url",
        "url": "https://mcp-gateway.getcakewalk.io/mcp",
        "name": "cakewalk",
        "authorization_token": "YOUR_OAUTH_ACCESS_TOKEN"
      }
    ],
    "tools": [{"type": "mcp_toolset", "mcp_server_name": "cakewalk"}]
  }'

The Anthropic SDKs for Python, TypeScript, Go, Java, C#, PHP and Ruby take the same two fields.

Step 4: Narrow the tool set (optional)

To hand the model a subset of the tools, disable everything by default and enable the ones you want:

{
  "type": "mcp_toolset",
  "mcp_server_name": "cakewalk",
  "default_config": { "enabled": false },
  "configs": {
    "some_tool_name": { "enabled": true }
  }
}

This trims what the model sees. It is not governance. Cakewalk Policies still decide every call that reaches the Gateway.

Verifying It Works

Ask the model what tools it has. The tools surfaced through the Gateway appear in the response, and tool activity comes back as mcp_tool_use and mcp_tool_result blocks tagged with the server_name you chose. In Cakewalk, open the Audit Log: every call made with this token is recorded there with its Policy decision.

Approvals Do Not Prompt Here

The MCP connector supports tool calls only. It does not carry MCP elicitation, the channel Cakewalk uses to show an inline approval prompt. A call that hits a Require approval Policy has nowhere to ask, so the outcome falls back to a company setting that defaults to Deny. Scope this token's work to tools that auto approve, or ask your Admin about the fallback setting first. See The Tool Call Lifecycle.

Troubleshooting

• Calls fail with an authorization error: the access token expired after 8 hours. Refresh it with the refresh token, or run the sign in flow again.
• "Server must be referenced by exactly one MCPToolset": every entry in mcp_servers needs exactly one matching mcp_toolset in tools, and no server may be referenced twice.
• Tools call successfully but return a denial: the Policy decision was Deny. The denial text explains why. Check the Audit Log entry for the Policy that fired.
• A local MCP server will not connect: the connector reaches public HTTPS endpoints only. Local stdio servers are not supported.

Learn more

• MCP connector from Anthropic.
• Get started with Claude from Anthropic.