Overview
The EPR Buddy connector is a hosted Model Context Protocol server for producer-side compliance work. It uses Streamable HTTP and per-user OAuth. Each connection is bound to one selected producer account and the permissions approved during consent.
https://api.eprbuddy.com/api/mcpEPR Buddy does not require a GitHub account. Git for Windows may be required by the Claude Code desktop experience, but it does not grant connector permission. Connector access is controlled by EPR Buddy OAuth, the user's live account access, and any Claude organization policy.
Requirements
- An active EPR Buddy user with access to the producer account being connected.
- A Claude plan and client that supports remote MCP connectors.
- Organization approval if the customer's Claude Team or Enterprise policy restricts custom connectors.
- A modern browser for the EPR Buddy sign-in and consent screen.
While EPR Buddy is added as a custom connector, Claude may display an external-link warning. An organization owner can review this documentation, the privacy notice, the endpoint, and the requested permissions before allowing it.
Connect Claude
- Open Claude's connector settings and choose to add a custom connector.
- Enter EPR Buddy as the name and use the MCP endpoint shown above.
- Leave the optional OAuth client ID and client secret blank so Claude can register its public client.
- Choose Add, then sign in to EPR Buddy when the browser opens.
- Select the producer account, review the requested permissions, and approve the connection.
- Enable EPR Buddy from Claude's connector menu for the conversation or task.
Claude Code uses the same MCP endpoint. Its OAuth flow returns to a short-lived localhost callback on the user's computer. Hosted Claude uses Claude's hosted callback. Both callback families are explicitly allowlisted by EPR Buddy.
Permissions and tools
Every tool is producer-scoped. Read tools are labeled read-only. Tools that create, update, approve, calculate, simulate, or submit information are separately labeled as state-changing so Claude can show the appropriate confirmation behavior.
| Permission | What it enables | Example tools |
|---|---|---|
| Platform read | Documentation, workspace pages, records, calculations, and reports | Read page, list records, explain calculations |
| Data write | Inputs, uploads, state setup, and material mappings | Add input data, register upload, configure state |
| Approvals write | Publish or revert reviewed inputs and promote reviewed calculations | Manage data approval, run compliance calculation |
| Scenarios write | Create and simulate producer planning scenarios | Manage scenario |
| Reports write | Generate producer-scoped draft reports | Generate report |
| Feedback write | Submit product feedback or reply to an owned feedback item | Write feedback |
Available permissions are limited by the user's current EPR Buddy role. Removing a user's producer access or revoking a connector immediately prevents future authorized MCP requests.
OAuth and data flow
The connector uses OAuth 2.0 authorization code flow with PKCE S256, dynamic client registration, short-lived access tokens, rotating refresh tokens, exact resource binding, and registered redirect validation. Personal EPR Buddy passwords are entered only on EPR Buddy's sign-in page and are not shared with the MCP client.
- Claude discovers EPR Buddy's protected resource and authorization server metadata.
- The user signs in to EPR Buddy, selects one producer, and approves a defined permission set.
- EPR Buddy issues a short-lived, producer-bound credential to the registered client.
- Claude sends that credential only to the EPR Buddy MCP endpoint.
- EPR Buddy rechecks the user, producer access, scopes, and token status on each request.
Tool responses return the producer data needed for the requested task to Claude. Claude's handling of that response is governed by the customer's Claude plan, configuration, and agreement. See the EPR Buddy Privacy Notice for more information.
Administrator review
An organization owner or security reviewer can use this checklist before approving the connector:
- Endpoint host: api.eprbuddy.com, over HTTPS only.
- Authentication: per-user OAuth with PKCE and explicit consent.
- Access boundary: one producer account per connection, limited by live EPR Buddy roles.
- Write boundary: purpose-built tools only; arbitrary API path and body tools are not published.
- Credential storage: bearer credentials are not placed in URLs or prompts.
- Origin handling: missing server-to-server Origin headers and exact trusted Claude origins are accepted; untrusted browser origins are rejected.
- Revocation: available to the user or account administrator in EPR Buddy Agent access settings.
- Public documentation: this page and the Privacy Notice.
For a security questionnaire, data-processing review, or managed-authorization request, contact EPR Buddy support using the address below.
Disconnect and revoke
- Remove or disable EPR Buddy in Claude's connector settings.
- In EPR Buddy, open Profile, then Agent access.
- Revoke the OAuth connection or token associated with the client.
Disconnecting in Claude stops the client from using the connector. Revoking in EPR Buddy also invalidates server-side access and should be used when a device, user, or organization no longer needs access.
Support
For setup help, organization approval material, or connector incidents, email info@cloudbuddyapps.com. Include the approximate time, client type, and visible error message. Do not include passwords, bearer tokens, authorization codes, or producer source files.