This is the technical reference for developers and IT teams integrating directly with the Legatics MCP server: authentication, the available tools, rate limits, and environments.
Tip: Connecting an off-the-shelf AI assistant like Claude or Copilot? See Using AI assistants with Legatics instead. This article is for people building or configuring the integration itself.
Authentication
The MCP server uses OAuth 2.0, the same authorisation model as the Legatics API.
PKCE (Proof Key for Code Exchange) is mandatory for every client
There is no dynamic client registration. A system admin must create a connected app in the Legatics Administration System before any client can authenticate — see Create and manage connected apps
OAuth endpoint discovery follows the standard OAuth 2.0 authorization server metadata convention for your instance
Token | Lifetime |
Access token | 1 hour |
Refresh token | 30 days |
Authorization code | 10 minutes |
JWT hard cap | 90 days — after this, re-authentication is required even with a valid refresh token |
Available tools
The MCP server exposes four tools:
get_schema: returns the filter and output fields available for a given type, so a client can learn its shape before querying itget: reads records of a given type — matters, modules, sections, rows, documents, parties, and morefind_actions: for a given type and record ID, returns the write actions the current authenticated user is permitted to perform, along with each action's payload schemaact: performs one of the actions returned byfind_actions— for example updating a field, creating a nested record, or creating a new matter, module, section, or row
If a connected app's scopes don't permit writes, find_actions and act are not available and the connection is read-only.
Note: Uploading or downloading file content isn't available over MCP. act can create a Document or Revision record, but the file bytes themselves still have to go through the Legatics Public API.
Scopes
A connected app's scopes determine what it can access and whether it can write. The full scope list:
legatics_mcp— always required to use the MCP serverread_only— forces the connection to read-only, regardless of any other scopes grantedmattermoduledata_roomreportsuseraudit
See Connected apps explained for how scopes fit into the wider permission model.
Rate limits
100 requests per 60 seconds
Requests over the limit receive a
429response10 consecutive over-limit windows result in a temporary ban
Error responses
The server returns standard HTTP status codes. Common cases:
401: the access token is missing, expired, or invalid — re-authenticate or refresh403: the connected app's scopes, or the authenticated user's own Legatics permissions, don't allow the request429: rate limit exceeded (see above)
Environments
Production: follows your instance's URL pattern, for example
mcp.eu1.legatics.com
For the member-facing overview of the MCP server, see Legatics MCP explained.