Connect an AI assistant to Reqlio

Last updated 3 October 2026 · Model Context Protocol (MCP) server

Reqlio has an MCP server, so an AI assistant can work in your Reqlio workspace: list projects, search and edit requirements, trace them, and work with risks, verification and reviews. It is an open protocol, not tied to one vendor: Claude, ChatGPT, Cursor, VS Code and any other client that connects to remote MCP servers can use it.

Your server URL

Each workspace has its own address. It is the address you sign in at, followed by /mcp:

https://your-workspace.reqlio.eu/mcp

Signed in to Reqlio, you find it ready to copy under Settings → Integrations → AI assistants, with the steps below.

Claude

1. In Claude (web, desktop or mobile) open Customize → Connectors and choose Add custom connector.
2. Paste your server URL, click Add, then Connect.
3. Sign in to Reqlio on the page that opens and approve the access.

On a Team or Enterprise plan an organisation Owner adds the connector once under Organization settings → Connectors; each member then connects it under Customize → Connectors.

ChatGPT

1. Turn on Developer mode under Settings → Security and login.
2. Add a new app from ChatGPT's apps page, give it a name and paste your server URL.
3. Sign in to Reqlio when ChatGPT asks, and approve the access.

Developer mode depends on your ChatGPT plan; on Business and Enterprise an admin may have to enable it. ChatGPT needs the sign-in: it cannot use an API token instead.

Cursor

Add this to ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (one project), sign in when Cursor asks, then switch the server on under Customize:

{
  "mcpServers": {
    "reqlio": { "url": "https://your-workspace.reqlio.eu/mcp" }
  }
}

VS Code (GitHub Copilot)

Run MCP: Add Server from the command palette, or add this to .vscode/mcp.json. Start the server, trust it, and sign in when asked:

{
  "servers": {
    "reqlio": { "type": "http", "url": "https://your-workspace.reqlio.eu/mcp" }
  }
}

On Copilot Business or Enterprise, an admin has to enable the “MCP servers in Copilot” policy first; it is off by default.

Claude Code

claude mcp add --transport http reqlio https://your-workspace.reqlio.eu/mcp

Then run /mcp inside Claude Code and choose Reqlio to sign in.

Other clients

Any client that supports remote MCP servers over streamable HTTP can connect, Windsurf (Devin Desktop), Gemini CLI and Zed among them. Give it your server URL; a client that supports MCP's OAuth sign-in finds it on its own.

Using an API token instead of signing in

For a client that cannot sign in through a browser, such as a headless session or a script, create a personal API token under Settings → Integrations → API tokens and send it as a header:

Authorization: Bearer reqlio_pat_…

A read-only token keeps the assistant from changing anything. Tokens are shown once, stored only as a hash, and expire after the period you choose (at most a year). Creating one asks for your password.

What the assistant can do

The server offers tools for projects, specifications, requirements and their links, glossary, comments, risks, interfaces, FMEA, verification activities and campaigns, reviews, dispositions, baselines, gates, budgets and quality assessment. Every tool is labelled for your client:

• Read-only: listing, reading, searching and comparing. Clients usually run these without asking.
• Edits: creating and changing things. Every previous value stays in the item's history and can be restored.
• Destructive: deleting, unlinking, renumbering and imports that replace values. Clients ask you to confirm these.

A workspace in its read-only period after a trial refuses every write, whatever the client.

Permissions, privacy and disconnecting

• The assistant acts as you. It sees what you can see and changes what you may change; partner (supplier/customer portal) accounts cannot connect.
• What the assistant reads from Reqlio is sent to that assistant's provider (Anthropic, OpenAI, …) under your organisation's agreement with them. Reqlio does not choose or control the assistant you connect.
• Connected assistants are listed under Settings → Integrations → AI assistants, where you disconnect them. Changing your password or signing out everywhere also ends every assistant's access immediately.

How Reqlio protects the data on its side: Security.

For client developers

• Transport: streamable HTTP at /mcp.
• An unauthenticated request gets 401 with WWW-Authenticate: Bearer resource_metadata="…/.well-known/oauth-protected-resource/mcp".
• OAuth 2.1 authorisation code with PKCE (S256 only), public clients (token_endpoint_auth_methods_supported: none). Clients identify themselves either with a Client ID Metadata Document (an https client_id whose JSON lists the client's redirect_uris; client_id_metadata_document_supported: true) or through dynamic client registration at /register. Scopes: read-write, read-only.
• Tool annotations: title, readOnlyHint, destructiveHint, openWorldHint: false on every tool.
• Sessions: an idle session ends after 30 minutes, and each user keeps at most ten at a time (the oldest ends first). A request on an ended session gets 404; start a new one with initialize, as the protocol specifies. Close sessions you are done with (DELETE /mcp).

Questions or a client that does not connect: support@reqlio.eu.