Connect an assistant

One endpoint, for everything. Give a client this URL and nothing else: it registers itself, opens a browser, you approve it once, and from then on it holds its own tokens.

https://app.guardianmemory.com/mcp

Claude

On claude.ai and in the desktop app: Settings → Connectors → Add custom connector, then paste the endpoint. Claude opens a GuardianMemory tab, you log in and approve, and the connector goes live.

Claude Code

claude mcp add --transport http guardian https://app.guardianmemory.com/mcp

Then run /mcp inside Claude Code, pick Guardian, and sign in.

ChatGPT

Settings → Connectors → Create, paste the endpoint and choose OAuth. ChatGPT registers itself the same way Claude does.

Cursor, Windsurf, VS Code

Anything that reads an mcp.json takes the endpoint directly:

{
  "mcpServers": {
    "guardian": { "url": "https://app.guardianmemory.com/mcp" }
  }
}

Scripts and clients without OAuth

Create an API key on the API keys page. Keys start with gdn_, are shown once, and can be revoked individually. Send one as a bearer token:

Authorization: Bearer gdn_your_api_key

Or as X-API-Key. For clients that cannot set headers at all, the key can go in the path:

https://app.guardianmemory.com/mcp/gdn_your_api_key

Treat that URL as a secret — it is one.

What the assistant is told

On connection GuardianMemory sends the assistant its instructions: read the profile at the start of a conversation, search whenever the user refers to something it lacks context for, save durable facts as concise third-person sentences, one fact per memory, and never store secrets. You do not need to prompt for any of it.

The OAuth flow, for the curious

GuardianMemory is its own authorization server, so there is nothing else to set up. Clients register dynamically (RFC 7591), PKCE with S256 is mandatory, access tokens last a day, refresh tokens last 90 days and rotate on use — reusing an old one revokes the connection. Tokens are opaque and stored hashed. Scopes are memory:read and memory:write.

Disconnecting

Every approved app is listed on Connected apps. Disconnect one and its tokens stop working immediately; it will have to ask for approval again.