Connect to the hosted server

The hosted server runs at https://mcopenfoam.warehack.ing/mcp. Cases submitted to it run on a 20-core CFD host, one job at a time, in a queue shared by everyone who uses it.

Sign-in is OAuth through auth.supported.systems. Access is granted per account: an account the server’s operator has not added is refused at the sign-in screen.

1. Add the server. In Claude Code:

   claude mcp add --transport http mcopenfoam https://mcopenfoam.warehack.ing/mcp

2. Sign in. Start Claude Code and run /mcp. The server shows as needing authentication; choose it and pick Authenticate. A browser opens on auth.supported.systems: sign in and approve the consent screen. The browser then returns to Claude Code, and the server lists 25 tools.

3. Check who you are. Ask Claude for the server info. server_info returns "auth": "oidc" and "signed_in_as" with your account name. Every job you submit records the same name.

Other clients

Any client that follows the MCP authorization spec works the same way. It finds the sign-in details itself from the server’s discovery documents, registers itself, and opens the browser:

https://mcopenfoam.warehack.ing/.well-known/oauth-protected-resource/mcp
https://mcopenfoam.warehack.ing/.well-known/oauth-authorization-server

In Claude Desktop, add it as a custom connector with the URL above. In the MCP Inspector, choose Streamable HTTP and connect; it walks through the same sign-in.

Sessions

Clients receive a refresh token, so a session survives the access token’s expiry without a new sign-in. Server restarts do not sign anyone out: the sign-in state lives in the server’s database.

Files from the hosted server

The job-files route, GET /jobs/<job_id>/files/<path>, takes the same bearer token as the MCP endpoint. Most clients keep the token to themselves, so for results use job_coeffs, job_forces, job_archive and the job:// resources; see Get the results out.

When sign-in fails

What you see	What it means
auth.supported.systems says you do not have access	your account is not in the server’s access group; ask the operator
the client reports 401 after working for a while	the refresh failed; run /mcp and authenticate again
the client never opens a browser	it does not support MCP OAuth; use a client that does