Krobot: Kromatic's innovation knowledge in your AI chat

1. 1Pick your assistant below and open its MCP connector settings. No sign-in needed to browse, search and read. Your assistant asks you to sign in to Kromatic the first time you download a template or send feedback — free; no card, no approval.
2. 2Add the server URL: https://api.kromatic.com/mcp/krobotCopy URL
3. 3Ask your first question — try the prompt below.

claude mcp add --transport http krobot https://api.kromatic.com/mcp/krobot

claude mcp add --transport http krobot https://api.kromatic.com/mcp/krobot \
  --header "Authorization: Bearer mcp_oat_<hex>"

{
  "mcpServers": {
    "krobot": {
      "url": "https://api.kromatic.com/mcp/krobot",
      "headers": {
        "Authorization": "Bearer mcp_oat_<hex>"
      }
    }
  }
}

{
  "servers": {
    "krobot": {
      "type": "http",
      "url": "https://api.kromatic.com/mcp/krobot",
      "headers": {
        "Authorization": "Bearer mcp_oat_<hex>"
      }
    }
  }
}

{
  "mcpServers": {
    "krobot": {
      "httpUrl": "https://api.kromatic.com/mcp/krobot",
      "headers": {
        "Authorization": "Bearer mcp_oat_<hex>"
      }
    }
  }
}

Please add an MCP server named "krobot" at https://api.kromatic.com/mcp/krobot using the streamable HTTP transport. No sign-in is needed to start; if a later call needs an account, authenticate with OAuth — it will send me to Kromatic to sign in and approve access. Then confirm it's connected.

Summarise Kromatic's guidance on riskiest-assumption tests.

What is Krobot MCP?

Krobot MCP is Kromatic’s public Model Context Protocol server. It exposes Kromatic’s knowledge base—blog posts, innovation tools, program guides, and more—as structured resources that any MCP-compatible AI agent can query. Browsing, searching and reading need no sign-in. Downloading a template or sending feedback needs a free Kromatic account — no card, no approval — and your assistant shows Kromatic’s sign-in screen the first time it needs one. Paid courses and templates are bought on kromatic.com; no tool charges money. When a call does need an account, chat assistants sign in through Kromatic’s OAuth consent screen (Path 3, the primary path for Claude.ai, ChatGPT and Grok); zero-context headless agents authenticate via Path 1 (agent self-signup); and a Personal Access Token (PAT) path is offered for human-controlled accounts that want to grant a specific agent access.

MCP Endpoint

MCP-native clients connect to the Streamable HTTP transport at:

https://api.kromatic.com/mcp/krobot

Available Tools

Authentication — Path 3: OAuth 2.1 sign-in with consent (chat assistants)

Add https://api.kromatic.com/mcp/krobot as a custom MCP connector and you can search and read straight away, with no sign-in and no token to paste. The sign-in comes up only when you ask for a template download or send feedback. If your client can complete an OAuth flow — Claude.ai, Claude Code, ChatGPT connectors, Grok and similar — this is the path it takes, and your client does the rest: it discovers Kromatic’s authorization server from the protected-resource metadata, registers itself, and sends you to Kromatic to sign in and approve an explicit consent screen. Only then is a token issued, and your client stores and refreshes it for you.

The flow is OAuth 2.1 with PKCE; both Dynamic Client Registration and Client ID Metadata Documents are supported for client registration.

• Authorization server: https://api.kromatic.com
• Protected resource metadata: https://api.kromatic.com/.well-known/oauth-protected-resource/mcp/krobot

Headless clients that cannot run an OAuth flow — a cron job, a shell script, a framework with no browser — use agent self-signup (Path 1) instead.

Authentication — Path 1: Agent self-signup (headless agents)

https://api.kromatic.com/mcp/krobot answers list_resources, search_resources and read_resource with no credential at all; download_resource and feedback need one. Where a credential is sent, https://api.kromatic.com/mcp/krobot only accepts tokens with the mcp_oat_* (issued by Path 1 agent self-signup, or by the Path 3 OAuth flow) or mcp_pat_* (Path 2 PAT) prefix. The legacy 24h login JWT from /auth/login is not accepted at the MCP transport — calling it with such a token returns 401 bearer_token_invalid.

Path 1 is the entry point for any zero-context headless agent: a single POST with an agent-controlled email and an explicit newsletter opt-in returns an mcp_oat_* access token (30d) plus an mcp_ort_* refresh token (90d) in the response body. See the agent-signup request below the install tabs for the exact call.

Response (201):

{
  "access_token": "mcp_oat_<hex>",
  "refresh_token": "mcp_ort_<hex>",
  "token_type": "Bearer",
  "expires_in": 2592000,
  "refresh_expires_in": 7776000,
  "account_created": true,
  "email": "[email protected]"
}

Pass the access token as Authorization: Bearer mcp_oat_<hex> to https://api.kromatic.com/mcp/krobot. 409 means the email belongs to a real-password (human) account — use Path 2 below or pick a different email. 429 means a per-IP or per-email rate limit; back off and retry.

Take-over flow (Path 1 only)

If an agent self-signed up against [email protected], the human Alice can claim the account at any time: visit kromatic.com and run Forgot password on that email, or sign in via OAuth on the same email (either path links to the existing row). The agent’s previously issued mcp_oat_* token keeps working until revoked or expired; Alice is the human owner from then on.

Connecting from AI Clients

Claude Code (Path 3 primary, Path 1 fallback)

Add the server with no header and start asking questions — searching and reading need no sign-in. Claude Code can complete the OAuth flow itself (Path 3), so the first time you ask it for a template download or to send feedback it sends you to Kromatic to sign in and approve the consent screen:

claude mcp add --transport http krobot https://api.kromatic.com/mcp/krobot

If your client can’t complete an OAuth flow, sign up (below) for a headless access token instead, and install with it. Place --header after the positional URL — argparse-greedy.

claude mcp add --transport http krobot https://api.kromatic.com/mcp/krobot \
  --header "Authorization: Bearer mcp_oat_<hex>"

Claude Code (Path 2 — PAT, alternate)

Use this when a human already controls a Kromatic account and wants to grant a specific agent access (CI runners, headless workers, or simply a human-curated grant). PAT mint requires a short-lived login JWT first:

# 1. Login with kromatic.com credentials → short-lived JWT
curl -X POST https://api.kromatic.com/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "[email protected]", "password": "..."}'

# 2. Mint a PAT (response includes plaintext_token shaped mcp_pat_<32 hex>;
#    shown exactly once — the server only stores the hash)
curl -X POST https://api.kromatic.com/auth/api-keys \
  -H "Authorization: Bearer <login-jwt>" \
  -H "Content-Type: application/json" \
  -d '{"name": "my-laptop"}'

Install with the PAT:

claude mcp add --transport http krobot https://api.kromatic.com/mcp/krobot \
  --header "Authorization: Bearer mcp_pat_<hex>"

Revoke a PAT from the “API access” section of your user profile or DELETE https://api.kromatic.com/auth/api-keys/{id}. Revocation takes effect on the next request.

Other MCP clients

Any MCP client reaches the browse, search and read tools with no credential at all. For download_resource and feedback, a client that can run an OAuth flow needs no credential of its own (Path 3), and any client that can send an Authorization header works too: self-sign up via Path 1 (or accept a PAT from a human via Path 2). Either way, target https://api.kromatic.com/mcp/krobot.

Example: Semantic Search

{
  "tool": "search_resources",
  "arguments": {
    "query": "lean startup experimentation frameworks",
    "limit": 5
  }
}

Token Lifetime & Recovery

• Path 1 (mcp_oat_*): 30-day access token plus a 90-day mcp_ort_* refresh token. To recover from a lost token, call the agent-signup endpoint again with the same email — the response includes a fresh pair (with account_created: false).
• Path 2 (mcp_pat_*): never expires on its own — valid until you (or an admin) revoke it. Treat PATs like passwords.

Rate Limits & Fair Use

Agent self-signup is rate-limited per email and per IP (10 per IP per hour, 3 per email per day); back off on 429. OAuth client registration is rate-limited separately. Please use the service considerately — for higher-volume integrations, contact our contact form so we can plan for the load.

Agent self-signup

Path 1 is a single POST with an agent-controlled email and an explicit newsletter opt-in — no browser, no OAuth dance:

POST https://api.kromatic.com/agent/public/v1/auth/agent-signup

Request:

curl -X POST https://api.kromatic.com/agent/public/v1/auth/agent-signup \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[email protected]",
    "subscribe_to_news": false,
    "client_name": "my-agent"
  }'