Integrations / Goliath MCP Server

Goliath MCP Server

Connect Claude, ChatGPT, Cursor and other AI assistants to Goliath over the Model Context Protocol, acting with your own permissions and visibility.

About

Goliath runs a remote Model Context Protocol server. Connect an AI assistant to it and the assistant can work in your Goliath account — look up contacts and pipeline items, add notes, move cards, build filters, and everything else the developer API can do.

https://server.goliathdata.com/mcp

The server is the developer API over a different door. Every call runs as the person who connected it, with that person’s own permissions and visibility, and is limited to the scopes of the credential it uses. It cannot see or change anything you could not see or change in the app yourself.

Connecting

Set it up with one prompt

In the app, open Settings → Integrations → AI assistants (or press Set up an assistant on the API Keys page), pick your assistant and what it may do, and press Copy setup prompt. Paste it into the assistant and it does the setup itself. The prompt carries no key: the assistant opens a Goliath page in your browser, you sign in, and the connection gets its own API key, named like Claude Code on Nov 3. Delete that key in Settings → API Keys to disconnect it.

The prompts below are the sign-in versions with the Look things up access. The app writes the same text with the access you choose. They are generated from one template, shared/src/oauth/assistantSetup.ts, and a test fails if this page drifts from it. Each tells the assistant to run reads only, to stop on the first error, and to prove the connection by listing your Pipelines.

Claude Code

Connect Goliath to Claude Code for me. Goliath is the app where I keep my real estate leads, contacts and Pipelines. Do these steps in order.

1. Run this command:
   claude mcp add --transport http --scope user goliath https://server.goliathdata.com/mcp

2. Tell me, in one short sentence, to type /mcp, select goliath and choose Authenticate. If goliath isn't listed, tell me to restart Claude Code with `claude --continue` first. A Goliath page will open in my browser. I'll sign in there and choose "Look things up". Wait until I say I'm done.

3. When I say I'm done, check that it works. Use the goliath tools to find the operation that lists my Pipelines, run it as a read, and tell me how many Pipelines I have and what they're called.

Rules for setup: only run reads. Don't create, change or send anything in Goliath. If a step fails, show me the exact error and stop.

Codex

Connect Goliath to Codex for me. Goliath is the app where I keep my real estate leads, contacts and Pipelines. Do these steps in order.

1. Run:
   codex mcp add goliath --url https://server.goliathdata.com/mcp

2. Run:
   codex mcp login goliath --scopes read
   It opens a Goliath page in my browser. Tell me to sign in there and choose "Look things up", then wait for the command to finish.

3. Codex loads new servers when a session starts. Tell me to start a new Codex session and paste: check Goliath works. In that session, check that it works. Use the goliath tools to find the operation that lists my Pipelines, run it as a read, and tell me how many Pipelines I have and what they're called.

Rules for setup: only run reads. Don't create, change or send anything in Goliath. If a step fails, show me the exact error and stop.

Another assistant

Connect Goliath to you for me. Goliath is the app where I keep my real estate leads, contacts and Pipelines. Do these steps in order.

1. Add Goliath to your own settings as a remote MCP server named goliath:
   Address: https://server.goliathdata.com/mcp
   Transport: streamable HTTP
   Sign-in: OAuth 2.1 with dynamic client registration and PKCE.

2. Start the sign-in so a Goliath page opens in my browser. I'll sign in there and choose "Look things up". If you can't add a server that signs in this way, stop and tell me, and I'll come back for a key.

3. When I say I'm done, check that it works. Use the goliath tools to find the operation that lists my Pipelines, run it as a read, and tell me how many Pipelines I have and what they're called.

Rules for setup: only run reads. Don't create, change or send anything in Goliath. If a step fails, show me the exact error and stop.

Claude

Copy this address: https://server.goliathdata.com/mcp
In Claude, open Settings, then Connectors, and click Add custom connector.
Name it Goliath, paste the address, and click Add.
Click Connect. A Goliath page opens. Sign in and choose “Look things up”.
Ask Claude: What Pipelines do I have in Goliath?

ChatGPT

Copy this address: https://server.goliathdata.com/mcp
In ChatGPT, open Settings, then Apps & Connectors. Under Advanced settings, turn on Developer mode.
Click Create, name it Goliath, paste the address, and choose OAuth for sign-in.
Click Connect. A Goliath page opens. Sign in and choose “Look things up”.
In a new chat, turn on Goliath and ask: What Pipelines do I have in Goliath?

For an assistant that cannot sign in from a browser, choose Use a key instead in the app. It makes a key on copy and puts it in the prompt. That key sits in the assistant’s chat history, so use the sign-in version where you can.

With a key you make yourself

Claude Code, Cursor and other clients that send a header can connect with a developer API key. Create one in Settings → API Keys (see Generating an API key) with the scopes you want the assistant to have, then pass it as a Bearer token.

Claude Code

claude mcp add --transport http goliath https://server.goliathdata.com/mcp \
  --header "Authorization: Bearer gsk_..."

Cursor (~/.cursor/mcp.json), and any client configured the same way. Cursor connects with a key: its sign-in returns through a cursor:// address Goliath does not accept.

{
  "mcpServers": {
    "goliath": {
      "url": "https://server.goliathdata.com/mcp",
      "headers": { "Authorization": "Bearer gsk_..." }
    }
  }
}

Claude.ai and ChatGPT

Add the URL above as a custom connector, sign in to Goliath, and choose what the connection may do. The connection gets its own API key with the scopes you chose. To disconnect it, delete that key in Settings → API Keys.

Other apps can sign in the same way, but Goliath marks them as unverified on the consent screen and they can’t be granted Admin. Goliath verifies an app by where sign-in sends you back to, never by the name it gives itself.

The one exception is a sign-in you started from the setup prompt in the last 15 minutes, from an app on your own computer (Claude Code, Codex). The consent page then names the assistant, shows the access you chose, and explains that the sign-in returns to your own computer instead of showing the unverified warning. Admin still needs a key.

Tools

The server exposes four tools that together reach the whole operation catalog, so an assistant searches for what it needs instead of loading hundreds of tool definitions.

Tool	What it does
`search_operations`	Finds operations by words in their name or description, optionally within one domain (contacts, tasks, …). Each result says whether your credential may run it.
`describe_operation`	Returns one operation’s variables, input shapes, response shape and an example — the same detail as `GET /api/v1/operations/:operationId`.
`run_read_operation`	Runs a read and returns the API response. It refuses writes.
`run_write_operation`	Runs a write — it creates, changes, sends or spends for real — and returns the API response. It refuses reads.

ChatGPT

A ChatGPT connection sees a short set of named tools instead of the four above, one per task. Each runs one operation from the same catalog, as you and with the access you granted, exactly as run_read_operation and run_write_operation would.

Tool	What it does
`search_contacts`, `get_contact`	Finds contacts by name, phone, email or address, and reads one contact’s full record.
`list_contact_activity`	Reads a contact’s timeline: calls, texts, emails, notes and voicemails.
`search_properties`, `get_property`	Finds properties by address, and reads one property’s owner, signals, tags and lists.
`list_pipelines`, `list_pipeline_stages`	Lists your Pipelines with stage counts and values, and one Pipeline’s stages.
`search_pipeline_items`, `get_pipeline_item`	Finds pipeline items by title, contact, Pipeline, stage or outcome with totals, and reads one pipeline item.
`list_tasks`	Lists your own tasks: due today, overdue, upcoming or completed.
`add_note`, `create_task`, `complete_task`	Adds a note to a contact, creates a task on one, or completes (or reopens) a task.
`create_contact`, `update_contact`	Adds a contact, or renames one, replaces its important note, or adds a phone or email.
`create_pipeline_item`, `move_pipeline_item`	Adds a pipeline item to a Pipeline stage, or moves one to another stage. Entering a stage can start that stage’s automations.

No tool sends a text, email or call itself, or spends credits. A pipeline item added to or moved to a stage can start that stage’s automations, which may text or email someone; create_pipeline_item and move_pipeline_item tell ChatGPT to confirm first. For anything else, connect a client that uses the four tools above.

Most clients ask before running a tool marked as a write. A refused call (a missing scope, a send the organization has not attested to, a rate limit) comes back to the assistant as an error carrying the error code and its message, so it can explain or adjust.

What a connection can do

A connection can do exactly what its key’s scopes allow:

Scope	The assistant may
`READ`	Run reads only.
`WRITE`	Also create and update records.
`ADMIN`	Also manage the team and settings and spend credits. Only a team admin’s key can carry it.
`IMPORT`	Also run CRM-migration writes (the `crmImport` operations). Only an org admin’s key can carry it.

For an assistant that should only look things up, create a READ-only key.

Sending texts and emails works only after an org admin makes the send consent attestation, exactly as for the API.
Spending (skip traces, phone numbers, credit packs) needs ADMIN and charges your organization as the app would — see Billing.
Retries: a write marked idempotent in the catalog accepts an optional idempotencyKey. The assistant sends a fresh unique value per distinct write, and the same value only to retry that exact call (same operation and variables): a write that already completed is not run again, and its stored result comes back marked replayed (see Retry-safe writes).

Disconnecting

Revoke the key in Settings → API Keys. The next call from that client is refused.