On this page
You are in your editor, halfway through a task. Your assistant asks for the acceptance criteria. You paste the issue. Half an hour later the project changes, and the conversation still holds the old copy.
Copy and paste works until somebody relies on it as current project state. I want an assistant to ask Bisonflow for the issue it needs, through a connection whose permissions you can inspect and revoke.
Development preview. That connection is now implemented on Bisonflow's dev track. Production rollout still needs approval. This describes the implemented scope, not a public production launch.
Six tools are enough to start
The current MCP connection can list accessible projects, list issues, search issue titles, read an issue, create an issue and update its title, description, priority or due date.
That is the complete catalog. It does not expose deletion, billing, invitations, file downloads, database queries or arbitrary code execution. An assistant cannot ask for another internal function by name.
Search uses the existing project index. Lists return small pages instead of exporting a workspace. Descriptions have a size limit. The goal is to bring back the information needed for the current question without filling a model's context with unrelated records.
The server does not run another model to interpret a tool call. Your AI client already chose a typed operation. Bisonflow validates it and applies the existing project rules.
Connect once, choose the boundary
Open Settings > MCP & connections and choose your AI app. Copy its server URL, add the remote HTTP server in your client, then connect with OAuth.
Bisonflow asks you to check the client name and return address. Choose the workspace and optionally restrict access to one project. Read-only is the default. Issue changes need a separate permission at consent, and your client should still ask before writing.
Codex desktop and CLI can use the same server configuration. Claude Code and Gemini CLI have setup instructions in Settings. Cursor and VS Code also have documented install buttons. There is no universal one-click link that every client supports, so I have not invented one.
A desktop client can reach a local development server. A hosted AI application needs a public HTTPS address. Availability also depends on the client's account and MCP support. The Codex documentation and Claude Code guide describe their connection options.
Permission belongs to the server
A connection belongs to one user and workspace. Existing membership, project visibility and subscription rules still apply. Giving a connection write scope does not turn a viewer into an editor or unlock an archived project.
Access tokens expire after one hour. Refresh rotates credentials within the connection's 30-day lifetime. Reusing a consumed refresh token revokes the connection. You can revoke access immediately in Settings.
An issue description may contain instructions planted by somebody else. Those words are data, not permission. Clients must keep that distinction and retain approval for changes. The AI provider receives the workspace content its client reads, which is another reason to approve only clients you trust.
Retries should not create two issues
Every write includes a retry key. Repeating the same command with that key returns the original result. Reusing it for a different command fails. Receipts last 24 hours, so an ambiguous request outside that window needs a state check before another attempt.
Updates also include the issue's last observed modification timestamp. If another person changed the issue, the request fails rather than silently replacing their work.
Request, write and refresh quotas live in Convex, shared across app instances. They do not depend on a process-local counter. Requests and results stay bounded, and the protocol does not need a persistent session for each connection. The implementation follows the current MCP specification while retaining compatibility with older HTTP clients.
The built-in Agent remains another choice
Bisonflow's Agent beta keeps the conversation in the workspace. MCP lets an external assistant use the supported operations from where you are working. Both reuse the same task mechanics and project access rules.
The next gate is review and client acceptance on dev. Production edge traffic controls and hosted-client checks belong in that release decision too. I would rather describe six operations with clear limits than promise an assistant authority over everything.
