MCP server

Give ChatGPT, Claude, Cursor, and any other MCP client tools that map one-to-one to the API. It only ever acts with your key, so it can do exactly what you can, nothing more.

Hosted server#

The hosted server lives at https://www.leasync.ai/api/mcp and speaks MCP over HTTP. Use it for clients that cannot run a local process: ChatGPT on the web and in the mobile apps, Claude on the web and mobile, and any client that asks for a server URL. It accepts two credentials: sign in with Leasync (OAuth), for apps like ChatGPT that cannot hold an API key, and your personal API key as a bearer token, for Claude Code and anything that takes a header.

ChatGPT#

ChatGPT connectors never take an API key: they sign in. Set it up once on the web and it is available in the ChatGPT mobile apps on the same account.

In ChatGPT on the web, open Settings → Apps & Connectors (or Connectors) and turn on Developer mode under Advanced settings. Custom connectors need a paid ChatGPT plan.
Choose Create, name it Leasync, paste https://www.leasync.ai/api/mcp as the server URL, and pick OAuth as the authentication. Leave the client ID and secret blank: ChatGPT registers itself.
ChatGPT opens Leasync. Sign in if you need to, check the workspace it will act in, and choose Allow. You are sent straight back to ChatGPT with the tools attached.
In a chat, enable the Leasync connector (under the tools or + menu, or in Developer mode) and ask away. On your phone, the connector is already there under the same account.

What ChatGPT may do is decided when you connect: by default the connection can read and write, exactly as you can in the app. Disconnect it any time from Settings → Integrations → Connected apps in Leasync; its next call fails immediately.

Claude, Claude Code, and other clients#

Claude's custom connectors also sign in through OAuth: open Settings → Connectors → Add custom connector, paste the URL, and sign in when asked. Clients that take a header can use your key instead:

Claude Codebash

claude mcp add --transport http leasync https://www.leasync.ai/api/mcp --header "Authorization: Bearer lsk_live_..."

Any client config that takes a URLjson

{
  "mcpServers": {
    "leasync": {
      "type": "http",
      "url": "https://www.leasync.ai/api/mcp",
      "headers": { "Authorization": "Bearer lsk_live_..." }
    }
  }
}

A connector added on the web is available in that account's mobile app as well.

Note

Every request is authenticated on its own. The server keeps no sessions and no copy of your data: your key or OAuth token is exchanged for a short-lived token for your own user, and the same row-level permissions you have in the app decide what each tool can see or change. A revoked key or disconnected app stops working on the next call.

OAuth details#

For MCP clients that implement the authorization spec: the server answers unauthenticated calls with a 401 whose WWW-Authenticate header points at /.well-known/oauth-protected-resource/api/mcp. Leasync is the authorization server (/.well-known/oauth-authorization-server): authorization code with PKCE S256, dynamic client registration at /api/oauth/register, token and refresh at /api/oauth/token, revocation at /api/oauth/revoke. Scopes are read and write, the same two a personal key has; a request with no scope gets both, and the consent screen says so. Ask for read alone for a read-only connection. Access tokens last an hour and refresh tokens ninety days, rotating on every use.

Local server#

For Claude Desktop, Cursor, and other clients that launch a local process, the same tools are published on npm as @leasync/mcp and run with npx, so there is nothing to install. Add it to your client config with your key.

claude_desktop_config.json (or any MCP client config)json

{
  "mcpServers": {
    "leasync": {
      "command": "npx",
      "args": ["-y", "@leasync/mcp"],
      "env": { "LEASYNC_API_KEY": "lsk_live_..." }
    }
  }
}

Claude Codebash

claude mcp add leasync -e LEASYNC_API_KEY=lsk_live_... -- npx -y @leasync/mcp

Environment variables
Name	Type	Description
`LEASYNC_API_KEY`required	string	Your personal key.
`LEASYNC_API_URL`optional	string	Only set this if you are pointing at something other than `https://www.leasync.ai`.

Tools#

me reports who the key acts as. Every resource then gets the same set, named after the singular record.

Resource	Tools
clients	`list_clients` `get_client` `create_client` `update_client` `delete_client` `add_client_note`
spaces	`list_spaces` `get_space` `create_space` `update_space` `delete_space` `add_space_note`
deals	`list_deals` `get_deal` `create_deal` `update_deal` `add_deal_note`
brokers	`list_brokers` `get_broker` `create_broker` `update_broker` `delete_broker` `add_broker_note`
landlords	`list_landlords` `get_landlord` `create_landlord` `update_landlord` `delete_landlord` `add_landlord_note`
commissions	`list_commissions` `get_commission` `create_commission` `update_commission` `add_commission_note`
links	`list_links` `get_link` `create_link` `update_link` `delete_link`

List tools take the same filters as the matching endpoint plus limit and cursor. Create and update tools take a fields object of column values. Deals and commissions have no delete tool; links have no note tool, matching the API.

Tip

Give the MCP server a read-only key unless you want your assistant to change records. Delete tools ask the assistant to confirm with you first, but the key's scope is the real guardrail.