Remote server — `mcp.dodil.io`

The remote server is Dodil’s hosted MCP endpoint. It is already running; there is nothing to install, download, or configure. You paste one web address into your AI assistant’s settings, log in once in your browser, and the assistant can use Dodil on your behalf.

The one thing to copy


https://mcp.dodil.io

Paste it exactly as written — no trailing slash, no /mcp on the end, nothing after .io.

Some client apps show an example like https://mcp.example.com/mcp, which makes people add /mcp. You don’t need to. https://mcp.dodil.io/mcp does still work if you’ve already saved it that way, but https://mcp.dodil.io is the address we support and document.

How logging in works

You never create an API key, and you never paste a token. The flow is the same one you already know from “Sign in with Google” style buttons:

You add the connector with the address above.
Your assistant asks Dodil “who checks logins here?” and Dodil answers: https://id.dodil.io/realms/dodil — Dodil’s identity service.
A browser window opens on id.dodil.io. You log in with your normal Dodil email and password.
You approve the connection.
The browser hands a short-lived access token (a temporary pass, not your password) back to the assistant. Connected.

Under the hood this is OAuth 2.1 with PKCE — the current standard for “let an app act for me without giving it my password”. You don’t need to know any of that to use it; it’s listed here because some clients ask you to confirm the server supports it. It does.

For the technically curious — what the server advertises

An unauthenticated request to https://mcp.dodil.io returns 401 with:


www-authenticate: Bearer resource_metadata="https://mcp.dodil.io/.well-known/oauth-protected-resource"

That header is what makes a compliant client start the login flow by itself. The metadata document (RFC 9728, OAuth 2.0 Protected Resource Metadata) is public:


curl -s https://mcp.dodil.io/.well-known/oauth-protected-resource


{
  "authorization_servers": ["https://id.dodil.io/realms/dodil"],
  "resource": "https://mcp.dodil.io"
}

The authorization server is Keycloak 26.7.3 at https://id.dodil.io/realms/dodil, supporting PKCE (S256). Both CIMD (client-ID metadata documents) and Dynamic Client Registration are accepted, as are loopback redirect URIs (http://localhost/callback, http://127.0.0.1/callback) per RFC 8252.

Multi-tenant by design

The server is multi-tenant: every single request carries your token, and the answer is scoped to your organisation. Two customers connected to the same mcp.dodil.io never see each other’s buckets, apps, repositories or images. Inside your organisation, what you can do is governed by your roles and policies — the connector cannot grant you more access than you already have.

Security notes

Dodil never sees your password through the assistant. You type it on id.dodil.io in your own browser, exactly as you would on the Dodil console.
The access token is short-lived — roughly 15 minutes — and is refreshed silently. If you’re away long enough, you may be asked to log in again; that’s normal, not a fault.
Your assistant vendor never receives a Dodil secret. It holds a temporary token scoped to the Dodil MCP server only.
You can disconnect at any time, from the same Connectors screen you added it on. Removing the connector stops all access immediately.
Actions are audited against your user, the same as if you had run them in the CLI.

What’s exposed

The same tool surface as the local server — every product, mirroring the CLI:

Product	Example tools
Ignite	`ignite_app_list`, `ignite_app_logs`, `ignite_app_deploy`
DataK³	`k3_bucket_get`, bucket / table / vector operations
Git	`git_repo_list`, `git_repo_create`, `git_pr_list`
Registry	`registry_repo_list`, `registry_tag_list`
Scriptum	`scriptum_thread_run`, `scriptum_script_list`

One deliberate difference from the local server: code mode (dodil_exec) is refused over the remote server. That tool runs arbitrary shell commands, which is fine on your own laptop and not fine on a shared hosted endpoint. If you need it, use the local server.

Remote server — mcp.dodil.io