What is MCP?
The Model Context Protocol (MCP) is an open standard that enables AI applications to securely connect with external data sources and tools. MCP is supported by various AI tools including Claude Desktop, Cursor, VS Code, and other AI development environments. For detailed information about MCP, see:Getting Started
MCP works out of the box — no workspace configuration needed. Just add the server to your AI client and authenticate:Client Setup
Use the MCP server URL for your region:- Claude Code
- Claude Desktop / claude.ai
- Cursor
- VS Code
- Codex CLI
- Gemini CLI
- Other Clients
Run in your terminal:
Authentication
Coalesce Quality MCP uses OAuth2 with PKCE for secure authentication. This is the recommended way to connect — no API keys or tokens need to be pasted anywhere, and every action the AI takes is attributed to you, with a via MCP badge on the actor chip so it’s clear the change came from an AI assistant rather than the app. The flow is fully automatic:- When your AI client connects for the first time, your browser will open automatically
- If you are already logged in to Coalesce Quality, the consent screen appears directly. Otherwise, you will be asked to log in first.
- Select the permission level you want to grant (see Permissions below)
- Click Approve to authorize

Static tokens (legacy)
Long-lived workspace tokens (prefixedst-…) created under Settings → API still work with the MCP server — pass one as a Bearer token in the Authorization header of the MCP connection. Use this only when OAuth is not an option (for example, headless automation without a real user, or when user API access is disabled for the workspace).
We recommend OAuth for all interactive AI clients: actions are attributed to the real user rather than to a shared service identity, tokens can be revoked per-user, and the scopes granted match what that user’s role already allows.
Permissions
During authorization, you choose what level of access to grant. The available permission scopes on the consent screen are determined by your user role in the workspace — you will only see options that your role allows.
The set of MCP tools available to your AI assistant depends on the permissions you grant during authorization. For example, if you only grant read-only access, tools that modify data (like managing issues or deploying monitors) will not be available.
Disabling User API Access
Workspace admins can prevent users from authorizing third-party applications (including MCP clients) to access the Coalesce Quality API via OAuth. The toggle lives in Settings → Workspace and can be flipped on or off at any time by a user with the admin role — individual users do not need to take any action when the setting changes.
- New OAuth consent attempts from MCP clients are rejected with an explanatory message on the consent screen.
- Existing OAuth tokens issued to users stop working.
- Workspace-provisioned long-lived tokens (
st-…) and client credentials continue to work — use those if you need programmatic access in this mode.
Coalesce Quality MCP Tools
Once connected, your AI assistant has access to a wide range of tools for working with your data infrastructure. The tables below group them by purpose.Discovery and Search
Core Entity Operations
Data Lineage Analysis
Comprehensive Lineage
Upstream Analysis
Downstream Analysis
Cross-Entity Analysis
Orchestration
Issue and Incident Management
Impact Analysis
Data Quality and Monitoring
Executions
SQL Generation for Data Analysis
These tools generate the SQL that Coalesce Quality would run to analyse data, but the MCP server does not execute queries against your warehouse. The response includes the full
executedSql — run it yourself (or let your AI client run it through a separate warehouse connection) to get actual results. This keeps your data inside your own warehouse and avoids giving the MCP server any standing database credentials.Change Tracking and History
Database Changes
Git Integration
Write Actions
The tools in this section modify workspace data and require Write access (for issue/incident actions) during OAuth consent. If the user granted only read-only access, these tools will not appear in the client.