Log inSubmit server
Thalovant MCP logo

Thalovant MCP

Connects MCP clients to Thalovant control-plane and hub runtime APIs over stdio or Streamable HTTP.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Thalovant MCP

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "thalovant-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@thalovant/mcp-server"
      ],
      "env": {
        "THALOVANT_API_TOKEN": "YOUR_VALUE_HERE",
        "THALOVANT_ACCESS_TOKEN": "YOUR_VALUE_HERE",
        "THALOVANT_EMAIL": "YOUR_VALUE_HERE",
        "THALOVANT_PASSWORD": "YOUR_VALUE_HERE",
        "THALOVANT_API_URL": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

Automated check passed— started and listed 50 tools correctly (Today).

Overview

Thalovant MCP MCP server exposes Thalovant control-plane and hub runtime APIs as MCP tools over local stdio or Streamable HTTP. It supports public hub discovery, authenticated hub and runtime operations, memory and analytics queries, identity flows, and device sign-in. Use it when an MCP client needs to inspect Thalovant resources or send requests and actions to connected runtimes. Local clients can run the published Node.js package, while remote deployments can use the HTTP endpoint with bearer, JWT/JWKS, or OAuth introspection-based authentication.

Use cases

  • Discover public and private Thalovant hubs
  • Inspect runtime groups, capabilities, inventory, and marketplace skills
  • Query memory, analytics, health, and operation status
  • Send questions, actions, or code to Thalovant runtimes

Key features

  • stdio and Streamable HTTP transports
  • Thalovant control-plane and hub runtime tools
  • Scoped token and device-login authentication
  • Memory, analytics, marketplace, and runtime inspection
  • Remote request validation and optional audit logging

Tools50

What Thalovant MCP lets your agent do. Expand a tool for its parameters.

Verified live~17.4k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

10/10 checks healthy over the last 55d

What it can do

From the 50 tools this server returned when we ran it; 50 declare their own safety hints.

Can delete or modify data · 7Writes files · 1Handles credentials · 14Makes network requests · 48Read-only tools · 42
Network at startup3 connections
Files written at startupNone
Install scriptsNone
npm provenanceSigned build
Package age118 days
Maintainers1

Observed 2026-11-02 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 2d ago via OSV.dev · @thalovant/mcp-server (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

npm downloads1.8kPackage downloads in the last 30 days.
Last commit7d agoMost recent push to the default branch.
Availability100%Our rolling endpoint + install checks that succeeded.
Install checkPassedOur sandbox started it and listed its tools.
Tools exposed50Callable tools this server registers over MCP.

How Thalovant MCP works

What Thalovant MCP does

Thalovant MCP connects MCP hosts to Thalovant's control-plane and hub runtime APIs. Its tool surface covers public and private hub discovery, runtime-group inspection, marketplace and inventory queries, memory access, analytics, identity status, health checks, event waiting, and runtime interaction.

Runtime-facing tools include thalovant_ask, thalovant_query, thalovant_send_action, and thalovant_send_code. Control-plane tools expose operations such as listing hubs, retrieving hub details, checking operation status, examining runtime capabilities, and creating client identities. Device-login tools provide a browser-assisted sign-in flow for principals that do not have configured credentials.

How it works

The package is implemented in Node.js with the official Thalovant SDK and the MCP TypeScript SDK. Local agents communicate through stdio. Remote agents use Streamable HTTP at /mcp; the server also publishes protected-resource metadata at /.well-known/oauth-protected-resource.

Authentication can use a scoped Thalovant API token, an existing access token, or an email and password fallback. Public hub discovery can run without Thalovant credentials. For browser-based authentication, the server begins and polls an RFC 8628 device flow, retaining the device code and resulting token for the principal during the process lifetime.

Remote deployments can use static bearer tokens, JWT/JWKS validation, or OAuth token introspection. Request handling includes host and origin validation, CORS, rate limiting, body-size limits, secure headers, and session binding. Optional event storage supports resumability, and JSONL audit logs are available.

Setup and configuration

Run the published package with:

Terminal
npx -y @thalovant/mcp-server

A source checkout can be built with npm install followed by npm run build. Node.js 20 or newer is required.

For token-based control-plane access, set a scoped API token and, when needed, the API origin:

server.ts
export THALOVANT_API_TOKEN="tvpat_..."
export THALOVANT_API_URL="https://api.thalovant.com"

The server prioritizes THALOVANT_API_TOKEN, then THALOVANT_ACCESS_TOKEN, then THALOVANT_EMAIL with THALOVANT_PASSWORD. Credentials are read from the server environment or server-side principal files; tokens and passwords should not be sent through chat or tool arguments.

Tools and capabilities

The available tools include:

  • Public and authenticated hub listing and retrieval.
  • Operation status checks, admission waiting, health checks, and identity status.
  • Intent inventory, event waiting, analytics overview, and memory item access.
  • Marketplace skill, runtime-group marketplace, runtime-group inventory, and runtime-group configuration queries.
  • Hub runtime capability inspection.
  • Device login beginning, polling, and revocation.
  • Client identity creation.
  • Runtime requests through ask, query, action, and code operations.

API-token scope controls access. A read-oriented deployment can use hubs:read and memory:read; discovery-only access can use hubs:read. Runtime hub tools use Thalovant client identities rather than control-plane tokens.

Limitations and notes

Hub and runtime-group provisioning requires a paid plan in addition to the necessary scopes. Free-tier access can still discover marketplace entries and browse hubs, but installation and provisioning may be rejected. Marketplace results expose whether a skill is installable or requires purchase, allowing an agent to check access before attempting installation.

Hub updates and deletions use optimistic locking. The caller must first retrieve the hub and provide its current body-level etag; stale or missing values fail without applying changes. Hub name, namespace, and domain cannot be changed after creation, while runtime-group writes do not use etags.

Device-login polling is separate from beginning the login. The agent must show the returned verification URL and code to a person, then poll using the login identifier. Configured credentials are not replaced or revoked by this flow.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Thalovant MCP

Thalovant MCP is an MCP server that connects MCP clients to Thalovant control-plane and hub runtime APIs. Its tools discover hubs, inspect runtime groups and capabilities, access memory and analytics, manage device login, and send questions, queries, actions, or code to Thalovant runtimes over stdio or Streamable HTTP.

Install it by running `npx -y @thalovant/mcp-server` with Node.js 20 or newer. From a source checkout, run `npm install` and `npm run build`.

Authenticate with `THALOVANT_API_TOKEN`, `THALOVANT_ACCESS_TOKEN`, or `THALOVANT_EMAIL` plus `THALOVANT_PASSWORD`. If none is configured, use the device-login tools to sign in through a browser.

Yes. The server supports Cursor through its stdio transport, and it also supports remote MCP clients through Streamable HTTP at `/mcp`.

The required scopes depend on the tools used. Read-only access can use `hubs:read` and `memory:read`, while discovery-only agents can use `hubs:read`; provisioning and memory writes require additional scopes.

Related MCP servers

All in Developer Tools All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewThalovant MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/thalovant-mcp?style=directory)](https://allmcps.com/mcp/thalovant-mcp)
HTML Embed
<a href="https://allmcps.com/mcp/thalovant-mcp"><img src="https://allmcps.com/api/badge/thalovant-mcp?style=directory" alt="Thalovant MCP on AllMCPs" /></a>