Connect Any AI Assistant

Stori speaks the Model Context Protocol, so it is not tied to one assistant. Anything that speaks MCP can work in your workspace, under the same permissions your admin sets.

Two Ways to Connect

Every assistant connects to the same endpoint. What differs is how it proves who it is.

  • Sign-in (OAuth) — the assistant opens a Stori login and you click Allow. Used by claude.ai and ChatGPT connectors. Nothing to copy or store; see Connect Claude to Stori.
  • API key — you paste a token into a config file. Used by Cursor, the OpenAI API, Gemini CLI, n8n, and anything you build yourself.

Both reach exactly the same tools, both are scoped to your workspace alone, and both sit under the ceiling your admin sets in Settings → Integrations → AI Apps.

https://www.onestori.com/api/mcp

Create an API Key

Workspace admins can mint keys in Settings → Integrations → AI Apps → API keys.

  1. Click New key and name it after where it will live — “Cursor — Priya” beats “key 2” when you come to revoke it.
  2. Choose what it may do. Reads are grouped as Jobs, Candidates and Credits; writes and sourcing are separate scopes, and none of them can exceed the workspace ceiling.
  3. Copy the key. It is shown once and never again — Stori stores only a hash of it.

A key is a workspace-wide credential: anyone holding it can read every candidate you have interviewed. Treat it like a password, keep it out of shared documents and source control, and revoke it the moment a laptop or a person leaves.

Cursor

The quickest route is the one-click install link, which pre-fills the server for you — you add your key afterwards:

Add Stori to Cursor →

Or add it by hand to .cursor/mcp.json in your project, or ~/.cursor/mcp.json to have it everywhere:


{
  "mcpServers": {
    "stori": {
      "url": "https://www.onestori.com/api/mcp",
      "headers": {
        "Authorization": "Bearer sk_live_your_key_here"
      }
    }
  }
}

Restart Cursor and the Stori tools appear in the MCP panel.

OpenAI

The Responses API takes a remote MCP server directly, so Stori becomes a tool your own assistant can call:


{
  "type": "mcp",
  "server_label": "stori",
  "server_url": "https://www.onestori.com/api/mcp",
  "headers": {
    "Authorization": "Bearer sk_live_your_key_here"
  }
}

In ChatGPT itself, add Stori as a custom connector and sign in — the same OAuth flow Claude uses, no key required.

Google Gemini

Gemini CLI reads MCP servers from its settings.json:


{
  "mcpServers": {
    "stori": {
      "httpUrl": "https://www.onestori.com/api/mcp",
      "headers": {
        "Authorization": "Bearer sk_live_your_key_here"
      }
    }
  }
}

The Gemini SDKs can also pass an MCP session as a tool, if you are building your own agent rather than using the CLI.

Anything Else

Stori implements MCP over Streamable HTTP, stateless, supporting protocol versions 2024-11-05 through 2025-06-18. Any compliant client works: Claude Desktop, Claude Code, VS Code, Windsurf, Zed, n8n, or your own code. Point it at the endpoint, send the key as a bearer token, and call tools/list.

To check a connection from a terminal:


curl -X POST https://www.onestori.com/api/mcp \
  -H "Authorization: Bearer sk_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

What a Connection Can and Cannot Do

A connected assistant can read:

  • Your jobs and any role in full
  • A job's pool, or a person found by name or email across every role
  • Interview transcripts and the evidence in them, with quotes and timestamps
  • A candidate's report, their Stori record, and the transcript verbatim
  • Candidates side by side, and a pool ordered by strength of evidence
  • What interviews are booked, who can sit on a panel, and where offers stand
  • The pipeline across roles, and your credit balances

Within the permissions your admin has switched on, it can also add notes, move candidates, reject with a reason, invite to interview and schedule, draft offers against the salary band and route them for approval, source candidates externally, reveal contact details, and draft or send outreach. Every change is written to the audit log against the person whose connection or key made it.

It structurally cannot:

  • See any other company's data — access is locked to your workspace
  • Send an offer document to a candidate — that stays a deliberate act in the app
  • Read compensation from an offer list — figures appear only for a single offer case
  • Exceed the workspace ceiling — a capability switched off in Settings is refused whatever the key or grant was approved for

Candidate reports and transcripts unlock per candidate, on the same terms as in the app. A candidate you have not unlocked returns their identity and a note explaining what would release the rest.

Revoking Access

Both kinds of access are revoked in the same place: Settings → Integrations → AI Apps. Disconnect an OAuth connection, or revoke an API key. Either takes effect immediately — the next request from that assistant is refused.

Each key shows when it was last used, which is the quickest way to spot one nobody needs any more.