Integration reference
GoCodes MCP Server
GoCodes operates a hosted MCP server that connects AI assistants to asset tracking data. 31 tools, 25 read and 6 write. OAuth 2.1, no API keys.
Endpointhttps://mcp.gocodes.com/mcp
Table of Contents
What is the GoCodes MCP Server?
GoCodes operates a first-party hosted MCP server for physical asset tracking.
The GoCodes MCP server connects AI assistants to a GoCodes asset tracking account. It implements the Model Context Protocol, an open standard for giving language models access to external systems.
The GoCodes MCP server endpoint is https://mcp.gocodes.com/mcp
The GoCodes MCP server exposes 31 tools: 25 read tools and 6 write tools. Clients discover them automatically on connection. Every assistant action stays bounded by the user’s existing GoCodes role.
There is nothing to install, build, or self-host. In Claude, browse the connector directory for GoCodes and click Connect to Claude. You are taken to GoCodes to log in to your account. In other clients, you add the endpoint as a remote MCP server. Once signed in, the client discovers the available tools automatically.
The GoCodes MCP server operates on physical asset data only. That means equipment, tools, vehicles, and inventory tracked with QR codes, Bluetooth Beacons and GPS.
The GoCodes MCP server tracks physical assets, not digital media files. It is not a digital asset management connector. It does not handle media files, image libraries, or creative assets.
What makes the GoCodes MCP server different
Four properties define the server. Each is documented in full further down this page.
| 01 | Field-level patching. update_asset and update_task apply a patch, not a replacement. Only the fields named in the call change. |
| 02 | Rollback asymmetry. restore_assets reverts asset edits by day or date range. Task writes are logged and correctable, not reversible. |
| 03 | Identity-bound access. Every request runs as the signed-in user and inherits that user's GoCodes role. |
| 02 | A register that cannot be added to or emptied. The server cannot create or delete assets. It cannot delete tasks either. |
| PROPERTY | VALUE |
|---|---|
| Endpoint | https://mcp.gocodes.com/mcp |
| Transport | Remote MCP over HTTPS |
| Authentication | OAuth 2.1 with PKCE |
| Tool discovery | Automatic on connection |
| Tools exposed | 31 |
| Read tools | 25 |
| Write tools | 6 |
| Create or delete | No asset create or delete. Task create supported, no task delete. |
| Clients | Claude and ChatGPT, web and desktop app, plus any client supporting remote MCP with OAuth. |
| Rate limit | 100 requests per minute, per user |
| Distribution | Listed in the Claude connector directory. Browse connectors, find GoCodes, then Connect to Claude. Available as a ChatGPT Plugin, just look up the GoCodes Plugin and click '+' to add. Direct endpoint works in any other compatible client. |
| Availability | Included on all accounts during beta |
Architecture and transport
Hosted, not self-hosted
GoCodes runs the server. You do not deploy a process, provision a container, or maintain a runtime. The client connects to a URL over HTTPS and the connection is live immediately after sign-in.
This differs from two other patterns common in the asset tracking category.
The first is the locally installed server. A package runs on the user’s machine and holds credentials on disk.
The second is the aggregator wrapper. A third-party automation platform sits between the AI client and the vendor API. It exposes only the subset of actions it has chosen to support.
In the wrapper pattern, the aggregator defines the tool surface, not the vendor. The vendor’s permission model is not enforced at the tool layer.
The GoCodes server is first-party. GoCodes owns the tool surface, the authorization logic, and the audit trail. All three match the behaviour of the application itself.
No key management
The GoCodes MCP server uses no API keys, so there is nothing to generate, rotate, store, or revoke. Authentication happens through the GoCodes’ login page during the first connection. The client stores a scoped token, never a password.
This matters operationally. API keys are long-lived shared secrets that outlive employment and are difficult to attribute. The MCP server issues per-user tokens instead.
Data handling
The GoCodes MCP server reads from your GoCodes’ account live. It does not create a second copy of your data. GoCodes does not retain MCP request or response content.
GoCodes does not permit AI providers to train on customer data. Customer data is not shared with AI systems beyond the user session context needed to answer the request in front of it.
What the AI client does with a response after it is returned is governed by that client provider’s terms, not by GoCodes. Review those terms alongside the GoCodes MCP beta addendum.
Authentication
OAuth 2.1 with PKCE
The GoCodes MCP server uses OAuth 2.1 with Proof Key for Code Exchange. On first connection, the client redirects you to the official GoCodes’ sign-in page. You authenticate there with your normal GoCodes email and password.
Your credentials are never transmitted to the AI client and are never stored by it. The client receives only a scoped, expiring access token.
PKCE protects the authorization code exchange against interception. It is the required flow for public clients under OAuth 2.1, which includes desktop and browser-based MCP clients. The MCP authorization specification requires this flow for remote MCP servers.
Token lifecycle and refresh
GoCodes MCP access tokens expire after 15 minutes and refresh automatically in the background. GoCodes MCP refresh tokens last 8 hours, as does the login cookie. The authorization code itself expires after 5 minutes. When a session expires beyond recovery, the client prompts you to sign in again. No manual token rotation is required.
| TOKEN | Lifetime |
|---|---|
| Authorization code | 5 min |
| Access token (JWT) | 15 min |
| Refresh token | 8 hours |
| Login cookie | 8 hours |
Identity and attribution
Every GoCodes MCP request runs under the signed-in user’s identity. There is no shared service account and no robot user.
Two consequences follow.
Your row-level permissions apply. The assistant sees exactly the assets you see in GoCodes, and nothing beyond them.
Your audit trail stays accurate. Changes are attributed to you, not to a generic integration account.
An aggregator wrapper cannot do this. When a third-party automation platform brokers the connection, requests carry the platform’s credentials rather than yours, and the vendor’s permission model is never enforced at the tool layer.
Tool reference
The GoCodes MCP server exposes 31 tools. Clients discover them automatically and select the appropriate tool based on the request. 25 of the 31 tools are read-only. 6 can modify data and are documented separately under write semantics.
The canonical tool list lives in the server README. Check it for parameter-level detail and for tools added after this page was published.
Assets 15 toolsread
| Tool | Function |
|---|---|
search_assets
| Free-text search across the inventory, matching name, ID, serial number, model, and related fields. |
get_asset_details
| Returns the full detail record for a single asset, identified by its GoCodes ID. |
get_asset_history
| Returns the complete audit and change log for an asset, including any change made through the MCP server and any subsequent restore. |
get_asset_assignment_history
| Returns check-out and assignment history, including who held the asset and for how long.
Assignment changes written through update_asset appear here. |
get_asset_location
| Returns the last recorded location of an asset, as GPS coordinates with the date the position was captured. |
get_asset_picture
| Returns the asset photograph inline in the response. |
get_assets_batch
| Returns detail records for multiple assets in a single call. |
list_assets_by_location
| Lists assets at a given location, or returns a per-location count summary. |
list_checked_out_assets
| Lists all currently checked-out assets with assignee and due date. |
list_overdue_assets
| Lists checked-out assets past their return date, ordered most overdue first. |
list_maintenance_due
| Lists assets with upcoming or overdue scheduled service. |
list_asset_types
| Returns the asset types defined in the account. |
list_asset_attachments
| Lists files attached to an asset. |
get_custom_field_schema
| Returns the account's custom field definitions. |
summarize_customer_inventory
| Returns an account-wide or per-assignee inventory summary, including totals, value, and breakdowns. |
Kits2 toolsread
| Tool | Function |
|---|---|
list_kits
| Returns all kits, meaning grouped asset bundles, in the account. |
get_kit_contents
| Returns the assets contained in a specified kit. |
Tasks and scheduling7 toolsread
| Tool | Function |
|---|---|
list_tasks
| Returns all tasks with due dates, assigned assets, and customer information. |
get_task_details
| Returns the full detail record for a single task. |
get_tasks_for_asset
| Returns every task assigned to a given asset. |
list_my_tasks
| Returns tasks assigned to the authenticated user. |
list_task_statuses
| Returns the task statuses configured in the account. |
list_task_attachments
| Lists files attached to a task. |
list_upcoming_events
| Returns upcoming scheduled events. |
Account1 toolread
| Tool | Function |
|---|---|
list_customers
| Returns customers and assignees defined in the account. |
Asset editing and undo2 toolswrite
| Tool | Function | Role required |
|---|---|---|
update_asset |
Updates editable fields on a single asset, including status, home location, assignment and check-out state, service dates, costs, model, serial number, and custom fields. | Group Administrator or Asset Manager |
restore_assets |
Reverts recent edits. Previews the change set by default, then rolls affected assets back to their prior state for a chosen day or date range. | Group Administrator or Asset Manager |
Task writes4 toolswrite
| Tool | Function | Role required |
|---|---|---|
create_task |
Creates a task on an asset with name, description, due date, cost, and priority. Can assign the task in the same call. | Group Administrator or Asset Manager |
update_task |
Edits an existing task. Only the fields named in the call change. Every other field is preserved. | Group Administrator or Asset Manager |
assign_task |
Assigns a task to a user by email address. Omitting the email unassigns the task. | Group Administrator, Asset Manager, or Asset Assigner |
update_task_status |
Changes only a task's status, for example to In Progress or Completed. | Group Administrator, Asset Manager, or Asset Assigner |
The four task write tools require the Tasks’ feature enabled on the account.
The 25 read tools require no role beyond the ability to sign in. Each returns only the records the authenticated user can already see in GoCodes. Both asset write tools append to the asset’s audit trail.get_asset_historyreads that trail back, so every MCP asset change is inspectable through the read surface.Write semantics
OAuth secures the client, but field patching secures the asset. The first controls who connects. The second controls what a connected assistant can change.Field-level patching
update_asset and update_task both apply a patch, not a replacement. Only the fields named in the call are hanged. Every other field on the record is preserved exactly as it was.
An assistant asked to set a status will not clear a serial number. It will not reset a custom field. An assistant asked to move a task’s due date will not clear its description.
Field-level patching is the most important property of the GoCodes’ write model. Language models produce partial objects. A replace-semantics write destroys the fields a model omits.
Audit logging and attribution
Every asset write is recorded in the asset’s audit history and attributed to the authenticated user. The record matches the structure of a change made in the web interface or mobile app. Changes made through an assistant appear in the same reports and the same audit trail. Anyone reviewing asset history sees them. There is no separate MCP log to reconcile. Task writes are attributed to the same signed-in user and appear in GoCodes as ordinary task activity.Rollback with restore_assets
is the undo path for assets. It runs in preview mode by default. The preview returns the assets and fields it would revert, before anything changes.restore_assets reverts by day or date range, not by individual transaction. GoCodes writes every restore_assets call to the asset audit log. A restore can therefore be reversed by a further restore.GoCodes MCP rollback covers asset edits only. There is no equivalent undo for task writes.
A create_task, update_task, assign_task, or update_task_status call cannot be reverted through the MCP server. Correct a task by writing to it again, or by editing it in GoCodes.
This asymmetry matters when planning agent workflows. Asset edits are reversible. Task edits are corrigible but not reversible.
A task rollback path is not planned. A task carries a small number of fields, and any change can be corrected by hand in GoCodes.Hard limits: the asset register cannot be added to or emptied
The GoCodes MCP server cannot create assets and cannot delete them. Nor can it delete tasks. These operations are absent from the tool surface entirely, not gated behind a permission. What the server can create is tasks.create_task adds work management records against assets that already exist. It does not add anything to the register itself.
That distinction is the boundary worth holding. An AI assistant connected to GoCodes reads through 25 tools and writes through 6. It can amend an asset, and it can raise work against an asset. It cannot introduce an asset into the register and cannot remove one.
In asset tracking, the register is itself the audit artefact. A read-heavy tool surface is now common across connectors and is not by itself a safety property. What makes agent access defensible here is identity. Every read and every write carries the name of the person who asked, enforced at the GoCodes layer rather than by the connector.
Why writes apply immediately
update_assetapplies on call. It does not stage a change for confirmation. That is deliberate.
An asset register earns its value from completeness. A blocked write leaves the register wrong and leaves no record that anything was attempted. A logged write preserves more evidence than a refused one.
Write confirmation prompts decay into reflexive approval. A user asked to approve every field change learns to approve without reading. The prompt stops being a control and becomes friction.
GoCodes places the control after the write instead. Every change is attributed and logged. Asset changes are also reversible, and restore_assets previews before it acts, because a revert carries the wider blast radius.
Task writes are the exception to reversibility. They are logged and correctable, not undoable.MCP or REST API: which to build on
The GoCodes MCP server and REST API are complementary, not substitutes. Both interfaces exist and solve different problems.
| Dimension | MCP server | REST API |
|---|---|---|
| Primary use case | Conversational queries, ad hoc analysis, human- directed edits | Scheduled syncs, system-to-system integration, bulk operations |
| Integration shape | Connect a client to a URL | Write and maintain application code |
| Who operates it | End user, no engineering involvement | Engineering team |
| Authentication | OAuth 2.1 with PKCE, per-user | API credentials, per-integration |
| Identity model | Acts as the signed-in user | Acts as the integration |
| Data freshness | Live on every call | Live on every call |
| Write capability | Field-level updates to assets and tasks, plus task creation and assignment | Full CRUD |
| Create and delete | Task create only. No asset create, no delete of anything. | Available |
| Maintenance burden | None. GoCodes maintains the server. | Yours. Schema changes require code changes. |
| Availability | All accounts during beta | Enterprise, or $1,080 per year add-on |
The GoCodes MCP server and REST API both return live data on every call. Neither reads from a cache or a scheduled export.
Choose MCP when a person needs answers from asset data and the work is exploratory. Reporting, spot checks, maintenance triage, and correcting field data all fit this shape.
Choose REST when a system needs asset data on a schedule. Choose it also when the workflow requires creating assets or deleting any record. Provisioning pipelines, ERP synchronisation, and bulk imports all fit this shape.
Many accounts run both. The MCP server does not replace the API and does not proxy it.
Worked example: morning equipment triage
A construction operations manager runs a daily check across active job sites. The sequence below shows which tools the assistant selects and where the write boundary sits.
| Step | Request | Tool called | Type |
|---|---|---|---|
| 1 | "Which assets are overdue for return, and who has them?" | list_overdue_assets |
READ |
| 2 | "What maintenance is due in the next two weeks?" | list_maintenance_due |
READ |
| 3 | "Show me the location and photo for asset 275UUSQ4." | get_asset_location, get_asset_picture |
READ |
| 4 | "Set 275UUSQ4 status to In Repair and its home location to Bay 3." | update_asset |
WRITE |
| 5 | "That was the wrong asset. Undo my changes from today." | restore_assets |
WRITE, preview first |
| 6 | "Raise a repair task on 275UUSQ4, due Friday, assigned to Maria." | create_task |
WRITE |
Steps 1 to 3 return data the manager could already see in GoCodes. Step 4 requires an editing role and writes two named fields. Every other field on the asset is unchanged. Step 5 previews the revert before applying it, and logs the restore itself.
Step 6 creates a record rather than amending one. It adds a task against an asset that already exists, and it can assign that task in the same call. No asset is created. The triage ends where the work starts.
The same sequence through the REST API requires an application and stored credentials. It also requires code for each query shape.
Client compatibility
Any MCP client that supports remote servers with OAuth can connect. GoCodes has tested Claude and ChatGPT. Both connect from the web app and the desktop app.
In Claude, open Settings, then Connectors, then Browse connectors. Find GoCodes and click Connect to Claude. You are taken to GoCodes to log in to your account.
Step-by-step guides with screenshots are published for Claude and ChatGPT.
ChatGPT connects to the same endpoint. Follow the ChatGPT guide for setup.
GoCodes MCP client support is defined by capability, not by a vendor list. Any client implementing remote MCP transport and the OAuth authorization flow will connect.
Clients that support only local stdio servers cannot connect. Clients that require API key authentication cannot connect.
Connect in three steps
1 |
Add the connector. In Claude, open Settings, then Connectors, then Browse connectors. Find GoCodes and click Connect to Claude. In ChatGPT, open Plugins, search for GoCodes and click '+' to add. In any other client, addhttps://mcp.gocodes.com/mcp as a remote MCP server. ChatGPT users should follow the ChatGPT guide. |
2 |
Log in with GoCodes. You are taken to the GoCodes’ login page. Authenticate with your normal email and password. The client receives a scoped token. |
3 |
Query your inventory. Ask a question in plain language. The client selects the appropriate tool and returns live data from your account. |
Example requests
Which assets are overdue for return, and who has them?
Summarize everything currently checked out to Maria.
What maintenance is due in the next two weeks?
Show me the details, current location, and photo for asset 275UUSQ4.
How many assets do we have by type, and what is their total current value?
What is in the Field Survey Kit?
Set the next service date for pump 275UUSQ4 to March 1st and its status to In Service.
Undo the changes I made to my assets today.
Raise a repair task on 275UUSQ4, due Friday, and assign it to Maria.
Mark the inspection task on the excavator as Completed.
Constraints and known limits
Published so that implementers can plan around them.
No asset create, no delete of anything.
The server cannot add assets to the register or remove them. It cannot delete tasks either. Use the REST API or the application interface for those operations.
Writes cover assets and tasks only.
Kits, locations, customers, and task statuses are read-only through MCP. Task statuses can be applied to a task, not defined.
Task writes cannot be rolled back.restore_assets covers assets. There is no task equivalent and none is planned. Correct a task by writing to it
Task tools require the Tasks feature.
All eleven task tools depend on Tasks being enabled on the account. Without it, the tools report that Tasks is not enabled. Contact your account representative to enable it.
No bulk write.update_asset operates on one asset per call, and update_task on one task. Bulk field changes belong in the REST API.
Broad queries degrade the experience.
Large result sets slow the response and consume the client’s context window. Narrow every request by location, assignee, type, or date. Ask for a summary rather than a full list where a count will answer the question. GoCodes does not publish a threshold at which this becomes noticeable.
Permissions cannot be widened from the client.
If a user cannot see or edit something in GoCodes, no prompt will change that. Permission problems are resolved in GoCodes’ account settings.
Restore scope is temporal.restore_assets reverts by day or date range, not by individual transaction. A restore may revert legitimate edits made in the same window. Check get_asset_history before restoring to see which changes fall inside the window.
The audit trail cannot be suppressed or modified.
Every write appends to the asset’s history and cannot be written silently. There is no flag to disable logging and no path to edit the trail. Restores are logged in the same way, so the record grows rather than resets.
Client support varies.
Remote MCP with OAuth is a relatively new capability. Clients that support only local servers cannot connect.
Rate limit of 100 requests per minute, per user.
Each user gets 100 requests per minute to the MCP server. Requests beyond that are throttled. Narrow queries and summary requests stay well inside the limit. Long multi-tool sequences across a large inventory are the workload most likely to reach it.
Beta contractual terms.
The connector is in beta and governed by the GoCodes MCP beta addendum, which limits GoCodes’ obligations for the duration. Review it before building a dependency on the server.
Availability and provisioning
The MCP server is in beta. Access is included on all plans for the duration of the beta, on every account type rather than a limited pilot group.
Beta use is governed by the GoCodes MCP beta addendum to the terms of service. The addendum records the specific amendments that apply to the MCP server beta. Read it before enabling the connector on a production account.
In summary, the addendum states that no service level agreement applies, that the software carries no warranty and may change or be withdrawn without notice, that the customer is responsible for its own backups and data protection, and that GoCodes’ liability is capped at fees paid in the prior three months, or at zero where the feature is free. Support during beta is best efforts.
The connector appears on the pricing page as MCP Server (Beta), listed under REST API Access and checked in every product box.
Provisioning is automatic and available to every paid account and free trial customer. Add the GoCodes connector in Claude, follow the ChatGPT guide, or set up the MCP server connection manually in another client.
Specifications and references
The GoCodes MCP server implements published open standards. These are the primary
sources.
Model Context Protocol specification
The protocol the server implements.
MCP tools specification
How clients discover and call tools.
MCP authorization specification
OAuth requirements for remote MCP servers.
OAuth 2.1 draft specification
The authorization framework the server uses.
RFC 7636, Proof Key for Code Exchange
The PKCE extension protecting the code exchange.
GoCodes MCP server repository
Source and issue tracker.
GoCodes MCP server README
The canonical tool list and parameter detail.
GoCodes MCP beta addendum
The contractual terms that apply during beta.
Frequently Asked Questions
Learn more about features, security, integration capabilities, and more!
What is the GoCodes MCP server endpoint?
The GoCodes MCP server endpoint is https://mcp.gocodes.com/mcp. Add it as a remote MCP server or custom connector in your client.
Is this a hosted or self-hosted MCP server?
Hosted. GoCodes operates the server. There is nothing to install, deploy, or maintain.
Where is my data stored, and is it shared with other companies?
Data remains in your GoCodes account. The server reads from it live and does not create a separate copy. GoCodes hosts on Microsoft Azure in the US East region, with offsite backups to alternate Azure locations. Traffic is encrypted in transit. GoCodes does not retain MCP request or response content.
Is my GoCodes data used to train AI models?
No. GoCodes does not permit AI providers to train on customer data. Customer data is not shared with AI systems beyond the user session context needed to answer a request. Each AI client provider sets its own terms for what it retains from a session, so review those alongside the GoCodes MCP beta addendum.
Do I need an API key?
No. Authentication uses OAuth. There are no keys to generate, store, or rotate.
Which OAuth flow does it use?
OAuth 2.1 with PKCE. You sign in on the official GoCodes login page. The client receives a scoped, expiring token and never sees your password.
How many tools does the server expose?
The GoCodes MCP server exposes 31 tools. 25 are read-only and 6 can write. The current list is maintained in the server README.
Which tools can write data?
Six. update_asset edits fields on a single asset and restore_assets reverts recent asset edits. create_task, update_task, assign_task, and update_task_status cover task creation and management. The other 25 tools are read-only.
Can the server create tasks?
Yes. create_task raises a task against an existing asset, with name, description, due date, cost, and priority. It can assign the task in the same call. The Tasks feature must be enabled on the account.
How are permissions enforced?
The server acts as the signed-in user and inherits that user’s GoCodes role. Row-level permissions apply unchanged. Asset writes require Group Administrator or Asset Manager. Task creation and editing require the same two roles. Task assignment and status changes also allow Asset Assigner.
Can the server create or delete assets?
No. Neither operation exists in the tool surface. The server can read assets and amend fields on existing ones. It cannot delete tasks either.
How do I roll back an agent's edit?
For assets, call restore_assets, or ask the assistant to undo recent changes. It previews the affected assets first, then reverts them for the chosen day or date range. The restore is itself logged and can be reversed.
Can I roll back a task change?
No, and no task rollback is planned. Correct the task by writing to it again, or edit it in GoCodes. A task holds few fields, so manual correction is straightforward.
Should I use the MCP server or the REST API?
Use MCP for conversational queries and human-directed edits with no engineering work. Use REST for scheduled syncs, bulk operations, and any workflow requiring asset creation or any deletion. See the comparison above.
Which MCP clients are supported?
GoCodes has tested Claude and ChatGPT. Both work on the web app and the desktop app. GoCodes is a listed connector in Claude, and the ChatGPT plugin listing is pending approval. Any client supporting remote MCP servers with OAuth will connect. Clients limited to local servers or API key authentication will not.
Is there a rate limit?
Yes. Each user gets 100 requests per minute to the MCP server. Requests beyond that are throttled.
Which plan includes MCP access?
All plans, for the duration of the beta, including free trial accounts. It is listed on the pricing page as MCP Server (Beta) under REST API Access. Provisioning is automatic, so there is nothing to request. Use is subject to the GoCodes MCP beta addendum.
How do I install it in Claude?
Go to Settings, then Connectors, then Browse connectors. Find GoCodes and click Connect to Claude. You are taken to GoCodes to log in to your account. There is a step-by-step guide with screenshots.
Is GoCodes available in ChatGPT?
Yes, as an approved Plugin in the ChatGPT Plugin directory.
Where is the full tool reference?
In the GoCodes MCP server repository on GitHub. The README carries the canonical tool list and parameter detail.