Core Unified API

Updated: October 12, 2026

The Unified MCP Server has two personalities:

• Connection mode — point it at a single end-customer connection and it exposes that connection's integration-specific tools (CRM contacts, accounting invoices, HRIS employees, and so on).
• Core Unified API mode — authenticate with only a workspace API key (no connection ID) and it exposes the Core Unified API management tools for your own workspace configuration data.

This page covers Core Unified API mode.

Note: Core Unified API mode operates on your workspace configuration data (connections, webhooks, integrations, API-call logs, issues, environments). It does not read or write your end-customers' data inside their connections — use a per-connection URL for that (see get_unified_connection_mcp_url).

Authentication

Provide a Unified.to workspace API key as the only credential. This is the "Private Workspace-only Authentication" method described in Authentication.

The token may be supplied either way:

All other options must be passed as URL parameters.

Deprecated: authenticating with ?token= still works, but responses to a request that authenticates that way now carry a Deprecation: true header (and a Sunset header once a date is set). Move the key into the Authorization header.

Warning: A workspace API key grants access to all of your connections and your entire Unified.to account. Treat it as a secret and never expose it in a shareable URL. To hand out access to a single connection, generate a connection-scoped URL with get_unified_connection_mcp_url.

Endpoints

Use the host for the region your workspace lives in. Regions no longer resolve across one another: each deployment sees only its own region's database, so a credential presented to another region's host resolves to "not found".

The MCP server runs as part of the Unified API, so <region API host>/mcp is the canonical address in every region — which is why AU is reached at api-au.unified.to. mcp-api.unified.to and mcp-api-eu.unified.to are long-standing aliases kept working for US and EU.

Transport

Streamable HTTP at /mcp is the only transport. The SSE transport has been removed. Migrating is a one-word URL edit — change /sse to /mcp and keep the same host, authentication and query parameters.

GET and POST on /sse and /sse/messages return HTTP 410:

{
    "error": "gone",
    "message": "The SSE transport has been removed. Use the Streamable HTTP endpoint at /mcp with the same authentication and query parameters. See https://docs.unified.to/mcp/core."
}

Client configuration

Send your workspace API key in the Authorization header, not in the URL. Where a client can read environment variables, the examples take the key from UNIFIED_API_KEY so it stays out of config files you might commit. Swap in your region's host from Endpoints.

Claude Code

Install the Unified.to plugin. It bundles the Core MCP server with our Agent Skills and prompts you for the API key, which it keeps in secure storage:

/plugin marketplace add https://docs.unified.to/.claude-plugin/marketplace.json
/plugin install unified@unified-to

Or add only the MCP server:

claude mcp add --transport http unified-core https://mcp-api.unified.to/mcp \
    --header "Authorization: Bearer $UNIFIED_API_KEY"

Codex

codex mcp add unified-core --url https://mcp-api.unified.to/mcp --bearer-token-env-var UNIFIED_API_KEY

Or in ~/.codex/config.toml:

[mcp_servers.unified-core]
url = "https://mcp-api.unified.to/mcp"
bearer_token_env_var = "UNIFIED_API_KEY"

Cursor

Add to Cursor (US host), or add this to .cursor/mcp.json in your project or ~/.cursor/mcp.json:

{
    "mcpServers": {
        "unified-core": {
            "url": "https://mcp-api.unified.to/mcp",
            "headers": {
                "Authorization": "Bearer ${env:UNIFIED_API_KEY}"
            }
        }
    }
}

VS Code (GitHub Copilot)

Add this to .vscode/mcp.json. VS Code prompts for the key the first time the server starts:

{
    "inputs": [
        {
            "type": "promptString",
            "id": "unified-api-key",
            "description": "Unified.to workspace API key",
            "password": true
        }
    ],
    "servers": {
        "unified-core": {
            "type": "http",
            "url": "https://mcp-api.unified.to/mcp",
            "headers": {
                "Authorization": "Bearer ${input:unified-api-key}"
            }
        }
    }
}

Other clients

Any client that speaks Streamable HTTP and supports custom headers:

{
    "mcpServers": {
        "unified-core": {
            "type": "http",
            "url": "https://mcp-api.unified.to/mcp",
            "headers": {
                "Authorization": "Bearer <workspace-api-key>"
            }
        }
    }
}

Via mcp-remote (for clients that only speak stdio):

{
    "mcpServers": {
        "unified-core": {
            "command": "npx",
            "args": ["-y", "mcp-remote", "https://mcp-api.unified.to/mcp", "--header", "Authorization:${AUTH_HEADER}"],
            "env": {
                "AUTH_HEADER": "Bearer <workspace-api-key>"
            }
        }
    }
}

Tools

Core Unified API mode exposes the following tools.

Search API Docs

Skills

See Agent Skills below.

Connections

Webhooks

Integrations

Issues

API calls

Environments

Agent Skills

In Core Unified API mode the server also serves Unified.to Agent Skills: step-by-step guides that teach a coding agent how to build with Unified.to. The skills are the same SKILL.md files published on this site; the server picks up changes within an hour.

The server serves these skills:

The skills directory has more, such as the guides to registering OAuth apps with each vendor; those are not served by the MCP server. All skills, the connection-mode guide included, are served only in Core Unified API mode, not on connection URLs or to enterprise-managed tokens.

MCP Skills extension

Clients that support the MCP Skills extension (io.modelcontextprotocol/skills) discover skills on their own. The server declares the extension, and the resources capability it requires, at initialize and server/discover:

{
    "capabilities": {
        "tools": {},
        "resources": {},
        "extensions": {
            "io.modelcontextprotocol/skills": {}
        }
    }
}

Each skill is a single SKILL.md, addressed as skill://<name>/SKILL.md, for example skill://unified-quickstart/SKILL.md. Example skills/list result:

{
    "skills": [
        {
            "uri": "skill://unified-quickstart/SKILL.md",
            "frontmatter": {
                "name": "unified-quickstart",
                "description": "Add Unified.to integrations to an app: …",
                "license": "MIT",
                "metadata": {
                    "category": "quickstart",
                    "docs": "https://docs.unified.to/quick-start"
                }
            },
            "resources": [
                { "uri": "skill://unified-quickstart/SKILL.md", "digest": "sha256:…", "size": 6046 }
            ]
        }
    ]
}

Clients without the extension

Every other client reaches the same skills through two tools, list_unified_skills and get_unified_skill. The server's instructions tell the model to check for a matching skill before starting a build task.

Tip: To install skills locally instead, use the Claude Code plugin under Client configuration or npx skills add https://docs.unified.to. Skills installed that way work without the MCP server.

get_unified_connection_mcp_url

This is the bridge from Core Unified API mode into connection mode: manage your connections with your workspace API key, then generate a ready-to-use MCP remote URL for any individual connection. The URL exposes that connection's integration-specific tools over Streamable HTTP (/mcp).

Parameters

Any option supplied is baked into the returned URLs as a query parameter. See Server options for the full behavior of each one.

Removed: dc was a region hint that nothing routed on. It is no longer accepted here and no longer appears in generated URLs. Pick the region with the hostname instead.

Modes

The mode parameter selects the authentication method embedded in the generated URL:

Response

{
    "connection_id": "682e20be9ca303793060370f",
    "integration_type": "hubspot",
    "mode": "user",
    "mcp_url": "https://mcp-api.unified.to/mcp?token=682e20be9ca303793060370f-<nonce>-<signature>",
    "note": "USER mode: this URL uses a connection-scoped signed token. It is safe to share and grants access only to this single connection."
}

Breaking change: the response no longer contains sse_url. If your code reads that field, it now gets undefined — read mcp_url instead. The SSE transport it pointed at has been removed.

Example

Generate a shareable, read-only CRM URL for one connection by calling get_unified_connection_mcp_url with:

• connection_id: 682e20be9ca303793060370f
• mode: user
• permissions: crm_contact_read,crm_company_read
• hide_sensitive: true

The returned mcp_url can be dropped straight into any MCP client and only exposes the read-only CRM tools for that connection, with PII stripped from responses.