# MCP clients

> Connect VS Code or another MCP client to Register lookup over Streamable HTTP with a personal API key, without the key ending up in a file.

Register lookup (Beta) lets an MCP client look up CVR, Retsinformation, Statistics Denmark and Folketinget. The client connects to `https://mcp.komplai.dk/mcp` over Streamable HTTP and sends your personal API key as a Bearer header on every request. [Register lookup](https://developers.komplai.dk/tools/register-lookup) describes the tools.

## Before you start

- Your organisation's agreement includes Register lookup, and an administrator has given you access to it.
- API access to Register lookup is turned on for your account, so you can create a key with `mcp:read`. If it is not, Register lookup in the hub says so.
- Register lookup is approved for test data only.

## Create a key

1. In the hub, open **Register lookup** (`/modules/mcp`). The page shows the address and the configuration for your environment.
2. Choose **Create a key for Register lookup**. It opens **API keys** with Register lookup chosen.
3. Name the key, for example after the client and the computer, and choose how long it lasts.
4. Under **Review access**, check that `mcp:read` is selected and choose **Create API key**.
5. Copy the key. It is shown only once.

The key starts with `kp_live_` and is bound to you and your organisation. It reaches only what you have access to.

## Connect VS Code

1. In VS Code, run **MCP: Open User Configuration** from the Command Palette.
2. Merge the configuration below into your existing settings.
3. Start the server `komplai`. VS Code asks for the key in a hidden field, so it never ends up in a file.

```json
{
  "inputs": [
    {
      "type": "promptString",
      "id": "komplai-api-key",
      "description": "komplai personal API key (mcp:read)",
      "password": true
    }
  ],
  "servers": {
    "komplai": {
      "type": "http",
      "url": "https://mcp.komplai.dk/mcp",
      "headers": {
        "Authorization": "Bearer ${input:komplai-api-key}"
      }
    }
  }
}
```

This is the configuration Register lookup in the hub generates. It contains no key. It works in VS Code's extension host, not in Agent Host sessions. See [VS Code's MCP configuration reference](https://code.visualstudio.com/docs/agents/reference/mcp-configuration).

## Other clients

Another MCP client works if it supports Streamable HTTP and lets you send a fixed `Authorization: Bearer` header with your personal API key. Keys are never accepted in the URL. Keep the key out of shared configuration and command history: use the client's secret store or an environment variable.

To check your key and the connection without a client, start a session with `initialize`:

```bash
curl -i https://mcp.komplai.dk/mcp \
  -H "Authorization: Bearer $KOMPLAI_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"connection-check","version":"1"}}}'
```

A working key answers with the `initialize` result and an `Mcp-Session-Id` header. Without a key, the server answers 401 [api_key_required](https://developers.komplai.dk/errors/api_key_required). Set `KOMPLAI_MCP_SESSION_ID` to the `Mcp-Session-Id` from the response, and close the session again with the same key:

```bash
curl -X DELETE https://mcp.komplai.dk/mcp \
  -H "Authorization: Bearer $KOMPLAI_TOKEN" \
  -H "Mcp-Session-Id: $KOMPLAI_MCP_SESSION_ID" \
  -H "MCP-Protocol-Version: 2025-03-26"
```

Closing a session does not revoke the key.

## Sessions and limits

- A session is bound to your organisation, to you and to the key. Another key, or a revoked one, cannot use it.
- A key can have 5 sessions at a time. A session ends after 30 minutes without activity.
- A request body can be at most 4 MiB.
- Access is checked again on every request and every tool call, so a revoked key, an expired key or a withdrawn assignment stops working at once.
- Lookups follow your account's request limits.

## Pseudonymise text from the client

The client also lists tools to find personal data, pseudonymise text and put the originals back; they work only when the same key has `redact:detect` and you have access to Redact. They use regex only and do not find names.

## Where data goes

- The lookup parameters go to the register you query.
- Register lookup runs on komplai's EU infrastructure in Germany.
- Lookups and regex use no AI, and they do not count towards AI usage or your organisation's monthly AI spending cap.
- komplai does not store the text, queries or lists of labels in the Audit log. Metadata about access and usage is recorded.

## Revoke access

Revoke the key under **API keys** (`/api-access`) in the hub. The client's sessions stop working at once.

---

https://developers.komplai.dk/guides/mcp-clients