Fast Insight MCP

Connect AI assistants (Claude, ChatGPT, Cursor, VS Code, and other MCP clients) to your Fast Insight account. Create studies, start recruitment, read respondent transcripts, and pull the synthesis report straight from your AI client.

Server URL

https://fastinsight.ai/api/public/mcp

Stateless Streamable HTTP. There is no session to keep alive, which is what hosted MCP clients expect.

What you can do

Connecting your client

Create a key under Account → Developer first. Where you put it depends on the client, because they do not all let you send a header.

Clients that take the key directly

Claude Code

claude mcp add --transport http fastinsight https://fastinsight.ai/api/public/mcp --header "x-api-key: fi_live_..."

Cursor and VS Code have one-click buttons on the Account page. They write the same thing into the client's own config:

{
  "mcpServers": {
    "fastinsight": {
      "url": "https://fastinsight.ai/api/public/mcp",
      "headers": { "x-api-key": "fi_live_..." }
    }
  }
}

Notion (Custom Agents → Settings → Tools & Access → Add connection → Custom MCP server) accepts header-based authentication. A workspace admin has to switch on custom MCP servers first, under Settings → Connections.

Claude Desktop connects to remote servers through its Connectors UI, which has no field for a header. To use a key, bridge it locally with mcp-remote in claude_desktop_config.json:

{
  "mcpServers": {
    "fastinsight": {
      "command": "npx",
      "args": ["mcp-remote", "https://fastinsight.ai/api/public/mcp", "--header", "x-api-key:${FI_KEY}"],
      "env": { "FI_KEY": "fi_live_..." }
    }
  }
}

Keep the header argument free of spaces and put the value in env: Claude Desktop on Windows and Cursor both mangle spaces inside args.

Clients that connect in the browser

Claude on the web (Settings → Connectors → Add custom connector) and ChatGPT (developer-mode apps) take a URL and then run OAuth. Neither exposes a header field, so there is nothing to paste beyond the server URL:

https://fastinsight.ai/api/public/mcp

Add it, click Connect, and approve the permissions on the Fast Insight screen that opens. The tools you get are the same nine, with the same write access, as an API key. No key, no JSON, no client id to register.

These sessions were read-only until we became our own authorization server. The short version of why: an access token has to be bound to this specific server and has to carry our permissions, and the identity provider we were relying on could do neither, so a token could not be trusted with anything that writes or spends. We now issue those tokens ourselves.

Permissions

The key's scopes are enforced per tool. A read-only key connected to an AI assistant genuinely cannot create studies or spend money: the tool call comes back refused. That is tighter than an OAuth grant, which would hand the client one broad consent.

Panel launches additionally require launch:panel on top of launch:byop, so an assistant can build a study without being able to spend.

For developers: how the OAuth flow works

Fast Insight is the authorization server for this resource. Discovery, then a standard authorization-code flow with PKCE:

• PKCE is required, S256 only. A missing or plain challenge is rejected.
• resource is honoured (RFC 8707). Send it, and it must be the MCP URL exactly; a mismatch is invalid_target. Omitting it is accepted.
• Registration is either dynamic (RFC 7591, POST /api/oauth/register) or a Client ID Metadata Document: a client_id that is an https URL we can fetch. Nothing needs pre-arranging with us.
• iss is returned on every authorization response, success or error (RFC 9207), so a client juggling several servers can tell who answered.
• Refresh tokens rotate. Presenting a rotated one revokes the whole family, on the assumption that two parties now hold copies and we cannot tell which is you.
• Scope can narrow on refresh, never widen. Adding a permission means authorizing again, which means the researcher sees the consent screen again.
• Access tokens last an hour; refresh tokens sixty days. Revoke either at POST /api/oauth/revoke (RFC 7009), or from アカウント設定 → 開発者向け, which disconnects the app immediately.

What the consent screen shows, and why it matters

The app is identified by the host of its registered redirect URI: claude.ai, chatgpt.com, and never a name it supplied. Registration is open, so any app could call itself "Fast Insight"; the host is the part it cannot fake without controlling the domain. If you are building a client and your name does not appear on that screen, this is why.

Why launching from an AI tool asks for your approval

Fast Insight's whole job is ingesting free text written by paid respondents. When an agent reads a transcript or a report, that untrusted text sits in the same context as a tool that spends money, and an instruction hidden in a respondent's answer looks exactly like an instruction from you.

So the agent cannot approve spending. launch_study on a panel study returns a link; you open it in Fast Insight, see the exact cost against your balance, and approve there. The approval is tied to that one study and those exact numbers, can only be used once, and expires. Approving 10 interviews can never start 500.

Bring-your-own-participants studies cost nothing and launch directly.