Connecting an assistant

What this is

Dardaris speaks the Model Context Protocol, so an assistant you already use can read your portfolio and act on it without you copying anything across. The address is one URL:

https://www.dardaris.com/api/mcp

That is the whole configuration. There is no key to generate, no token to paste and nothing to keep secret in a file: the client sends you here to sign in, you say what it may do, and the credential it gets back belongs to that client and to no other.

Connecting

Claude, on the web or the desktop. Settings, then Connectors, then Add custom connector. Paste the address above. A browser window opens on the Dardaris sign-in, then on the screen that asks what this connector may do.

Claude Code. One command:

claude mcp add --transport http dardaris https://www.dardaris.com/api/mcp

Then /mcp inside Claude Code to sign in. The first call opens the browser for you.

Cursor, and anything else that reads an mcp.json. A remote server with no arguments and no environment:

{
  "mcpServers": {
    "dardaris": {
      "url": "https://www.dardaris.com/api/mcp"
    }
  }
}

Anything else. The server is discoverable: an MCP client that finds it needs signing in reads /.well-known/oauth-protected-resource, registers itself, and walks the OAuth flow on its own. Public clients and PKCE only. If your client asks for a client id and secret to type in by hand, it is on an older pattern than this server offers, and you can tell it to register itself instead.

What it asks you

The consent screen names the application, says what it will be able to do, and asks which portfolio it starts on. Two answers, and neither of them is buried:

• Read this portfolio. Leases, tenants, money, maintenance, documents, and everything the morning briefing is drawn from.
• Act on this portfolio. Record a change, file a document, start the things you would otherwise do on a screen.

A connection granted reading only cannot write, and cannot talk its way into writing later: refreshing a credential may narrow what it holds and never widen it. Whatever your autonomy caps hold back still waits for you, because an assistant reaches the same guardrails a screen does.

A portfolio is a team. The connection starts on the one you pick, and can be pointed at another team you are on. It can never be pointed at one you are not.

What it can see

Exactly what you can see, and nothing else. An assistant does not get a door of its own: every tool call it makes is a request back through the same API a browser uses, carrying its own credential, and every read is scoped by the team it is on. There is no argument, and no header, that reaches another owner's records.

Three things are deliberately out of reach whatever you grant:

• The admin workspace, which is the one part of the product that looks across accounts. It is a person's judgement in a browser and never a delegation an assistant inherits.
• The whole portfolio in one response. It is megabytes, most of it irrelevant to any one question, and reading the part that answers the question is both cheaper and clearer.
• Uploading a file's bytes, which is a browser's job.

What it can do

Six tools, over about sixty actions. Three of them are the ones an assistant reaches for first, so it never has to look them up: who this connection speaks for, this morning's briefing, and putting a question to the answering engine. The other three are how it reaches everything else: search the catalogue of actions, ask what one takes, run it.

That shape is deliberate. A tool for every endpoint would fill an assistant's memory with schemas before it had read a single record. This way it pays for a description only once it has decided it wants that action, and an endpoint added to Dardaris tomorrow is available to your assistant the same day, with no update on your side.

Three conventions are worth knowing, because a figure read the wrong way is worse than no figure. Money is integer cents, so 125000 is 1,250.00. Dates are YYYY-MM-DD. A booking range is half open, so the checkout date is the morning the guest leaves and a checkout and a check-in on one date is a turnover, not a clash. The same conventions the reports use.

Taking it back

Open /app/connect in the product. Everything you have let in is listed there with the portfolio it points at and what it may do, and Disconnect stops it at once: the credential it holds is refused on its next call, not at the end of some period.

A connection also lapses on its own. An access token lasts hours and is refreshed quietly in the background; if a client stops asking for ninety days, it has to be authorised again. Closing your account takes every connection with it, along with everything else, as the export and erase does.

If a credential is ever used twice where it should have been used once, the connection is closed rather than merely refused: presenting a spent secret is what a stolen one looks like, and the safe reading is that somebody else has it.

If something is wrong

The client says it is not registered. The consent screen refuses an application whose registration Dardaris does not hold, or one asking to be sent back to an address it never registered. Nothing is granted, and you should not type anything into it.

Nothing happens after you say yes. Check the address is the one at the top of this page and not a copy with a path after it. The connection is minted for that one endpoint.

It answers but says the result is too large. Ask for less. Most lists take a limit and page with offset, and the refusal says which.

Where the numbers come from: reports. What runs without being asked: what runs on its own.