> ## Documentation Index
> Fetch the complete documentation index at: https://conductorone-muhammad-kumail-native-mcp-tabs-batch.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Set up the Lucid MCP server
> Connect Lucid to C1 through the Lucid API or Lucid's own hosted MCP server, then register the server and govern its tools.
**Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
C1 can govern Lucid access two ways. Both let your AI clients read from and act on Lucid through governed MCP tools, but they come from different places and appear as two separate entries in your MCP server catalog:
* **Lucid MCP** — listed as plain **Lucid** in your catalog. C1 registers Lucid's own hosted MCP server (`mcp.lucid.app`) as a downstream server C1 governs. Authentication is always per-user OAuth using dynamic client registration (DCR) — Lucid's hosted MCP server doesn't support a bearer token or API key, so there's no application to create in Lucid first. Before anyone can connect, a Lucid account admin must enable MCP access for the account from the Lucid Admin Panel. Tool calls run with the connected user's full Lucid permissions.
* **Lucid API** — C1 hosts its own MCP server that translates Lucid's REST API into tools. You choose between per-user OAuth or a shared API token, and you scope access with the **scopes** you grant the Lucid OAuth application (or token).
| | Lucid MCP | Lucid API |
| :--------------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------- |
| **Who hosts the MCP server** | Lucid | C1 |
| **Authentication** | Per-user OAuth with dynamic client registration (DCR) only — no bearer token or API key option | Per-user OAuth, or a shared API token |
| **Access scoping** | The connected user's full Lucid permissions — not independently scoped | The OAuth **scopes** you configure on the application, or the token |
| **Tool surface** | Lucid's own tool set: document search, content retrieval, diagram creation (including org charts, mind maps, and UML sequence diagrams), image export, and sharing | Documents, folders, teams, and users, mapped to Lucid API endpoints |
| **Setup effort** | An account admin enables MCP access in Lucid, then register and authorize in C1 — nothing else to create in Lucid first | Create a Lucid OAuth application or API token first, then register it in C1 |
Use the native **Lucid MCP** option (listed as plain **Lucid** in your catalog) if you want Lucid's own broader, agentic tool set and per-user OAuth is acceptable for your tenant. Use **Lucid API** if you need a shared service-account credential (API token), or you want to scope access with OAuth scopes.
C1 registers as a client of Lucid's own hosted MCP server ([Integrate Lucid with AI tools using the Lucid MCP server](https://help.lucid.co/hc/en-us/articles/42578801807508-Integrate-Lucid-with-AI-tools-using-the-Lucid-MCP-server)) rather than translating Lucid's REST API itself. Your users' AI clients still only ever see C1-governed MCP tools, but C1 proxies each tool call straight through to `mcp.lucid.app` under the connected user's authorized session, then returns the result. The tools available are exactly the ones Lucid's own MCP server exposes — C1 doesn't reshape or add to them.
## Before you begin
* AI access management must be enabled for your tenant. See [Enable AI access management](/product/admin/enable-ai-access-management).
* A Lucid account admin must enable MCP access for the account from the Lucid Admin Panel before anyone can connect ([Integrate Lucid with AI tools using the Lucid MCP server](https://help.lucid.co/hc/en-us/articles/42578801807508-Integrate-Lucid-with-AI-tools-using-the-Lucid-MCP-server#for-admins-enable-or-disable-use-of-the-mcp-server-for-your-account)). Skipping this step means users won't be able to connect. If MCP access is enabled after a user has already signed in from a connected AI tool, that user may need to re-authenticate for the change to take effect ([Introducing the Lucid Model Context Protocol (MCP) server](https://community.lucid.co/community-news-and-announcements-9/introducing-the-lucid-model-context-protocol-mcp-server-12230)).
* Nothing else to create in Lucid ahead of time. This option only supports per-user OAuth with dynamic client registration — Lucid's hosted MCP server doesn't offer a bearer token or API key mode, so there's no client ID, secret, or application to register. Each user just needs a Lucid account with access to the workspace.
In your MCP server catalog, this option is listed as **Lucid** — distinct from the **Lucid API** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant.
## Set up per-user OAuth
Per-user OAuth with dynamic client registration (DCR) is the only authentication method this option supports — there's no bearer token or API key fallback. Each user authorizes individually, and C1 registers itself with Lucid's authorization server automatically, so there's no application to create in Lucid first (see Lucid's [Integrate Lucid with AI tools using the Lucid MCP server](https://help.lucid.co/hc/en-us/articles/42578801807508-Integrate-Lucid-with-AI-tools-using-the-Lucid-MCP-server#faq) documentation).
In Lucid, have an account admin go to the Lucid Admin Panel and enable MCP access for the account. This is a prerequisite — until it's enabled, users can't connect regardless of how the server is configured in C1.
Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Lucid** from the catalog.
When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **OAuth2 — per-user passthrough** and enable **Use dynamic client registration**. There's no client ID or secret to enter.
Save your changes. The first time a user calls a Lucid tool from their AI client, they're redirected to Lucid to sign in (if they aren't already) and approve the connection, then returned to C1.
## What access is granted
Unlike the Lucid API option, there are no separate scope toggles to configure in C1. Once a user authorizes, tool calls run with that user's full Lucid permissions — they can access everything the user can already access in Lucid, including documents and folders across Lucidchart, Lucidspark, and Lucidscale. This integration's tools can search for and open documents, read their contents and metadata, create and edit diagrams (including org charts, mind maps, and UML sequence diagrams), export documents as images, and manage sharing — creating share links and granting collaborators view, comment, edit, or edit-and-share access ([Integrate Lucid with AI tools using the Lucid MCP server](https://help.lucid.co/hc/en-us/articles/42578801807508-Integrate-Lucid-with-AI-tools-using-the-Lucid-MCP-server#available-actions); [Lucid MCP Server — Supported Operations](https://learn.microsoft.com/en-us/connectors/lucidmcpserver/)). Access follows your normal Lucid permissions — the integration can only reach documents and folders you can already see.
## How Lucid MCP credentials are shared
This option only supports per-user OAuth — there's no shared, service-account, or bearer-token mode. Every tool call runs under the calling user's own Lucid identity, and Lucid attributes each action to that individual. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage).
## Discover and govern tools
After you register the server, C1 runs tool discovery against Lucid's MCP server. Discovered tools appear on the server's **Tools** tab and include Lucid's own document search and fetch tools, diagram creation (including org charts, mind maps, and UML sequence diagrams), image export, and sharing.
Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
Before anyone can call a Lucid tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
Tool discovery runs even if authentication isn't complete yet, so seeing discovered tools doesn't confirm a user has authorized. You confirm access when an approved user successfully calls a Lucid tool from their AI client.
## Manage access to Lucid MCP
Because this option uses per-user OAuth, there's no shared secret in C1 to rotate. Users and admins manage access from Lucid itself:
* **An individual user can disconnect at any time.** In Lucid, open account settings and go to the **Authorized Websites and Applications** list, then select the app and choose the remove option to revoke it ([Access and update account settings](https://help.lucid.co/hc/en-us/articles/360049864551-Access-and-update-account-settings#apps-and-integrations-settings)).
* **An account admin can turn off MCP access for everyone.** In the Lucid Admin Panel, disable MCP access for the account. This revokes every AI tool and MCP client connected through Lucid MCP at once; users must re-authenticate if it's re-enabled later.
The Lucid MCP server lets you govern access to Lucid — documents, folders, teams, users, and account data — as tools your AI clients can call through C1.
Lucid supports two ways to authenticate, and you choose one when you register the server:
* **Per-user OAuth** (recommended). Each person authorizes with their own Lucid account, so every tool call runs under that user's Lucid identity and permissions.
* **API token**. A single token authenticates everyone, so all tool calls reach Lucid as one shared identity.
For a deeper comparison of shared versus per-user credentials, see [Configure authentication](/product/admin/mcp-servers#configure-authentication).
## How C1 connects to Lucid
C1 hosts the Lucid MCP server, so your users' AI clients only ever see MCP tools — they never call Lucid directly. When an AI client calls one of these tools, C1 makes the matching request to the Lucid API using the credentials you configure here, then returns the result to the AI client.
The credentials you set up below are what C1 uses to call Lucid on your users' behalf.
## Before you begin
* AI access management must be enabled for your tenant. See [Enable AI access management](/product/admin/enable-ai-access-management).
* A Lucid account that can register an OAuth 2.0 application in the developer settings.
* For an API token, the Lucid account whose access the token should carry.
In your MCP server catalog, this option is listed as **Lucid API** — distinct from the **Lucid** entry, which connects to Lucid's own hosted MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant.
## Option 1: Set up per-user OAuth
With per-user OAuth, you register one Lucid OAuth application and each user authorizes individually. This keeps every action attributable to the user who took it, with only the access that user already has in Lucid.
### Create a Lucid OAuth application
Register an OAuth 2.0 application in Lucid that users will authorize through. For more information, see Lucid's [OAuth 2.0 client creation](https://developer.lucid.co/docs/oauth-20-client-creation) documentation.
In Lucid, go to **Account settings** > **Developer** and create a new OAuth 2.0 application.
Set the **redirect URI** exactly to `https://accounts.conductor.one/auth/callback`.
Add the **scopes** your tools need, such as `lucidchart.document.content:readonly`, `folder:readonly`, `teams:readonly`, and `account.user:readonly`. Add write or admin scopes only if you plan to govern those operations.
Save the application, then copy the **Client ID** and **Client Secret**. Lucid shows the client secret only once.
### Register the server with OAuth
With your OAuth application ready, register the server and provide its credentials to C1.
Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Lucid API** from the catalog.
When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose per-user OAuth and enter your OAuth application's **client ID**, **client secret**, and **scopes**.
Save your changes. The first time a user calls a Lucid tool from their AI client, they're prompted to connect their Lucid account.
## Option 2: Use an API token
A Lucid API token authenticates every user as one shared Lucid identity. Use this when per-user attribution in Lucid isn't required.
### Create a Lucid API token
Generate an API token in Lucid for C1 to authenticate with. For more information, see Lucid's [API keys](https://developer.lucid.co/docs/api-keys) documentation.
In Lucid, go to **Account settings** > **Developer** and create or open an OAuth 2.0 application.
Generate an API token for that application, granting only the **scopes** you need, such as read access to documents, folders, and teams.
Copy the token. Lucid shows the token only once.
For a shared production setup, create the token from a dedicated service-account user so activity is attributable to C1 rather than a person.
### Register the server with a token
With your API token ready, register the server and provide it to C1.
Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Lucid API** from the catalog.
When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Bearer token** and paste your API token.
Save your changes. C1 starts a sync that discovers the tools the Lucid server exposes.
## How Lucid credentials are shared
How Lucid sees your users' activity depends on the method you chose:
* **Per-user OAuth.** Each user authorizes with their own Lucid account, so tool calls run under that user's Lucid identity and inherit only the access they already have. Lucid attributes each action to the individual user.
* **API token.** Every user's tool calls use the one token you provided, so Lucid sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage).
For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication).
## Discover and govern tools
After you register the server, C1 runs tool discovery against Lucid. Discovered tools appear on the server's **Tools** tab.
Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
Before anyone can call a Lucid tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your Lucid credentials when an approved user successfully calls a Lucid tool from their AI client.
## Manage your Lucid credentials
* **Rotate the OAuth client secret** in your Lucid OAuth application under **Account settings** > **Developer**, then update the secret on the server's authentication settings in C1.
* **Rotate an API token** by generating a new one in Lucid and updating it in C1, then revoking the old token.
* **Adjust access** by editing the application's scopes in Lucid.