A URL containing your org id looks like a secret and is not one — people paste them into tickets. CoreStory's documentation is explicit that the URL is not the grant: sign-in is, and removal from the org cuts access at once. That makes the address safe to share internally. On the tools, sections_only with paging is the detail that keeps a large tech spec usable — an agent can read the headings and then one section rather than the whole document.
CoreStory's endpoint, addressed per organisation — the URL contains your org slug and id. Fourteen tools split between reading generated documents, holding conversations about the codebase, and searching the index behind them.
- list_projects, get_project_prd, get_project_techspec — the generated documents, whole or by named section with paging
- list_conversations, get_conversation, create_conversation, rename_conversation, send_message — a persistent conversation per topic
- refine_document_definition, generate_document, get_document_generation_result — shape what a document should contain, then generate it asynchronously
- semantic_search, describe_index, filter_chunks — query the index, and inspect what is in it
A CoreStory account with a project already ingested, and browser sign-in through Clerk. Access follows the account rather than the URL: being removed from the organisation ends MCP access immediately.
Paste a URL, then authorize — add the endpoint to your client, then approve the OAuth consent screen