MCP Server

Quick start

Add this URL to your MCP client and sign in with your Winston AI account:

https://api.gowinston.ai/mcp/v1

No API key and no install are needed. The server uses the Streamable HTTP transport and OAuth 2.1. Credits are taken from your Winston AI account.

Connect your MCP client

Your client signs you in with OAuth 2.1 the first time you connect.

Claude

Go to Customize > Connectors, click +, then Add custom connector. Enter Winston AI as the name and https://api.gowinston.ai/mcp/v1 as the URL, then sign in.

ChatGPT

Turn on Developer mode in ChatGPT settings, then add a custom connector with the URL https://api.gowinston.ai/mcp/v1 and OAuth as the authentication. Custom connectors require a paid ChatGPT plan.

Claude Code

claude mcp add --transport http winston-ai https://api.gowinston.ai/mcp/v1

Cursor

Add to your mcp.json:

{
  "mcpServers": {
    "winston-ai": {
      "url": "https://api.gowinston.ai/mcp/v1"
    }
  }
}

VS Code

Add to your .vscode/mcp.json:

{
  "servers": {
    "winston-ai": {
      "type": "http",
      "url": "https://api.gowinston.ai/mcp/v1"
    }
  }
}

Other MCP clients

Use the URL https://api.gowinston.ai/mcp/v1 with the Streamable HTTP transport. Any client that supports MCP authorization signs you in automatically.

Using an API key instead

You can also use a standard API key from our API platform by passing it in the Authorization header. Credits are then taken from your API platform account.

{
  "mcpServers": {
    "winston-ai": {
      "url": "https://api.gowinston.ai/mcp/v1",
      "headers": {
        "Authorization": "Bearer your-winston-ai-api-key"
      }
    }
  }
}

Tools

Tool	What it does	Inputs	Credit cost
`ai-text-detection`	Detects whether text was written by a human or AI, with a confidence score and the most AI-like sentences	`text` (required, 300 to 150,000 characters, 600+ recommended), `file` (optional, .pdf, .doc or .docx), `website` (optional, public URL)	1 credit per word
`ai-image-detection`	Detects AI-generated images using metadata, watermark detection, and a machine learning model	`url` (required, public JPG, JPEG, PNG or WEBP image, at least 256x256 pixels)	300 credits per image
`plagiarism-detection`	Checks text against web pages and lists the original sources	`text` (required, 100 to 120,000 characters), `language` (optional, default `en`), `country` (optional, default `us`)	2 credits per word

If you provide several inputs to ai-text-detection, website takes priority over file, and file takes priority over text.

Authentication

Every request must send a Bearer token in the Authorization header:

Authorization: Bearer <token>

The token is either:

An OAuth 2.1 access token with the mcp:use scope. Your MCP client gets it for you when you sign in with your Winston AI account.
A standard API key from the API platform.

Never send the token in the request body or URL. Only the Authorization header is supported.

How the OAuth 2.1 flow works

MCP clients that support MCP authorization handle this for you:

A request without a token receives 401 Unauthorized with a WWW-Authenticate header pointing to the protected resource metadata.
The client reads https://api.gowinston.ai/.well-known/oauth-protected-resource, which lists https://app.gowinston.ai as the authorization server and mcp:use as the required scope.
The client opens your browser so you can sign in to Winston AI and approve access.
The client receives an access token and sends it as Authorization: Bearer <token> on every request.

Test with cURL

For quick tests with cURL, use a standard API key from the API platform. Replace your-winston-ai-api-key with it.

List tools

curl --location 'https://api.gowinston.ai/mcp/v1' \
--header 'content-type: application/json' \
--header 'accept: application/json, text/event-stream' \
--header 'Authorization: Bearer your-winston-ai-api-key' \
--data '{
  "jsonrpc": "2.0",
  "method": "tools/list",
  "id": 1
}'

Call a tool

curl --location 'https://api.gowinston.ai/mcp/v1' \
--header 'content-type: application/json' \
--header 'accept: application/json, text/event-stream' \
--header 'Authorization: Bearer your-winston-ai-api-key' \
--data '{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "ai-text-detection",
    "arguments": {
      "text": "Your text to analyze (minimum 300 characters)"
    }
  }
}'

To call another tool, change name and arguments using the Tools table.

Troubleshooting

401 Unauthorized: The token is missing, invalid, or expired. Sign in again from your MCP client, or check that the header is Authorization: Bearer <token>.
403 Forbidden: The token doesn’t have the mcp:use scope. Disconnect and sign in again so your client requests it.
Out of credits: Top up your Winston AI account. If you use an API key, top up on the API platform.
Your client doesn’t support OAuth: Use an API key in the Authorization header. See Using an API key instead.

Self-hosting

To run the MCP server locally, see the Winston AI npm package.

API Documentation

Endpoints

Quick start

Connect your MCP client

Claude

ChatGPT

Claude Code

Cursor

VS Code

Other MCP clients

Using an API key instead

Tools

Authentication

How the OAuth 2.1 flow works

Test with cURL

List tools

Call a tool

Troubleshooting

Self-hosting

​Quick start

​Connect your MCP client

​Claude

​ChatGPT

​Claude Code

​Cursor

​VS Code

​Other MCP clients

​Using an API key instead

​Tools

​Authentication

​How the OAuth 2.1 flow works

​Test with cURL

​List tools

​Call a tool

​Troubleshooting

​Self-hosting

Quick start

Connect your MCP client

Claude

ChatGPT

Claude Code

Cursor

VS Code

Other MCP clients

Using an API key instead

Tools

Authentication

How the OAuth 2.1 flow works

Test with cURL

List tools

Call a tool

Troubleshooting

Self-hosting