Clients without built-in OAuth

Most MCP clients sign in with OAuth — point them at https://gateway.ansvar.eu/mcp and approve the browser login. Those recipes live on the Setup page. This page is for the clients that can't do that: ones that only accept a fixed Authorization header, or that run on a server with no browser.

A pasted token on its own won't hold — every token the gateway issues is short-lived and expires within minutes, and these clients don't refresh. The fix depends on whether your client can run a small local helper.

Clients that can run a local helper

AnythingLLM Desktop and custom scripts can launch a local command. Use mcp-remote, a community helper that performs the OAuth login and token refresh on the client's behalf and exposes the gateway as a local server. Your client talks to the helper; the helper talks to Ansvar. This removes the expiry problem entirely — it runs in OAuth mode, not as a static header.

Requires Node.js 18 or newer — use a currently supported LTS (18 itself is past end-of-life). In AnythingLLM, edit plugins/anythingllm_mcp_servers.json (or Settings → Agent Skills → MCP Servers):

{
  "mcpServers": {
    "ansvar": {
      "command": "npx",
      "args": ["-y", "mcp-remote@0.1.38", "https://gateway.ansvar.eu/mcp"],
      "env": {}
    }
  }
}

On first start your browser opens to the Ansvar login; after that it reconnects on its own. For long-running unattended setups, request a longer-lived refresh with the offline_access scope:

"args": [
  "-y", "mcp-remote@0.1.38", "https://gateway.ansvar.eu/mcp",
  "--static-oauth-client-metadata", "{\"scope\":\"mcp:tools offline_access\"}"
]

Custom code

Writing your own client? Use the MCP SDK and pass your own OAuth access token as a Bearer header to https://gateway.ansvar.eu/mcp. Obtain it via OAuth 2.1 Authorization Code + PKCE against auth.ansvar.eu/realms/ansvar, and refresh it yourself — access tokens are short-lived.

Get your first cited answer

Paste one of these tasks exactly as written. Each reads one source, so it runs on every plan, Free included, and you get the law's text with a link you can open.

In AnythingLLM, start the message with @agent: MCP tools only run inside an agent session. Then paste the task.

An EU regulation article. You should get the text of Article 17 (right to erasure), linked to eur-lex.europa.eu.

Using Ansvar, retrieve GDPR Article 17 and show its official source link.

A national law provision. You should get the German text of § 26 BDSG (employee data), linked to gesetze-im-internet.de.

Using Ansvar, retrieve section 26 of the German Federal Data Protection Act (BDSG) and show its official source link.

NIS2 obligations for a sector. You should get the ten measures in Article 21(2), linked to eur-lex.europa.eu.

Using Ansvar, retrieve NIS2 Article 21 and list the cybersecurity measures an energy company must take. Show the official source link.

DORA incident reporting for a bank. You should get the initial notification, intermediate report and final report of Article 19(4), linked to eur-lex.europa.eu.

Using Ansvar, retrieve DORA Article 19 and list the reports a bank must file after a major ICT-related incident. Show the official source link.

What a good answer looks like: the text of the provision, its article or section number, and a link to the official publisher. Your client should also show a call to an Ansvar tool, usually get_provision. An answer with no tool call and no source link came from the model's memory: lead the message with "Using Ansvar" and add the routing instructions.

Headless and static-header-only clients

Some clients can't use the helper — they connect over HTTP with a fixed header and can't run a local command, or they run on a server with no browser for the one-time login. This includes n8n, Open WebUI, AnythingLLM in Docker, CI/CD jobs, and agents built on the Gemini API or Google ADK, which pass a fixed bearer header instead of running an OAuth flow (see Connect Gemini). These need a scoped, revocable service credential rather than a browser login.

Service credentials are org-owned seats

A service credential belongs to an organization. On Premium it takes a seat of its own, like a team member does (your sign-in holds a seat too); Team and Company include five per workspace that take no seat, and each further credential takes one. It carries a signed-in seat's tool surface on your plan — search, provision lookup, citation validation, workflow runs, document upload and report generation — with two carve-outs: the audit-ledger decrypt and architecture-proposal assent surfaces are human-only and refused to credentials, and each credential's monthly workflow-run ceiling defaults to half a seat's (see Service credentials). There are no static API keys — a service credential is an OAuth2 client-credentials client, and your server exchanges its secret for short-lived access tokens at auth.ansvar.eu. That exchange is the catch for a client that can only hold one fixed header and never re-requests a token: it needs something in front of it that refreshes, because the token expires within minutes.

On Premium, Team and Company, an organization admin creates one directly in the account area → Service credentials — no request needed. The full recipe, including the token exchange and the rotate/revoke rules, is on Service credentials. On Free and Solo, with the client you're connecting and the organization it belongs to, and we'll work out the right shape.

Troubleshooting

401 / "Authentication required" on connect — the client sent no valid login. Use the helper above, or connect with a service credential.
Works for a few minutes, then 401s — a static token expired. Use the helper's OAuth mode, which refreshes; don't paste a token.
404 at the endpoint — the MCP endpoint is https://gateway.ansvar.eu/mcp, not the bare host.
Cryptic node:fs/promises crash — the client launched npx under an old Node. Install Node 18+ and make sure it's first on the client's PATH.