Connect Claude, ChatGPT to Tino (MCP)

Tino Connector lets AI assistants (Claude, ChatGPT, other MCP apps) work with a Tino account: view and manage hosting services, VPS, domains, DNS records, invoices and tickets with plain-language requests, only within the scopes the customer approved. The connection uses the MCP (Model Context Protocol) standard and OAuth sign-in: the assistant never sees the customer's password or OTP code.

Updated: 2026-10-27. MCP server source code: the public repository tinovn/tino-connector-mcp.

Overview

Connecting

Claude (web, Desktop, mobile)

1. Open Claude, go to Customize → Connectors, and click Add custom connector.
2. Name: Tino; URL: https://api.tino.vn/mcp.
3. Leave authentication at the default (OAuth sign-in); no client ID or header is needed.
4. Click Connect: the Tino sign-in page opens (see Signing in and granting access).

Depending on the Claude plan, an organization admin may need to enable the connector first.

Claude Code

Install the tino plugin:

claude plugin marketplace add tinovn/tino-connector-mcp

claude plugin install tino@tinovn

In Claude Code, type /mcp, select tino, and click Authenticate. Without the plugin, add the MCP server directly, then also run /mcp → Authenticate:

claude mcp add --transport http tino https://api.tino.vn/mcp

Claude Code does not register a client: it identifies itself with a Client ID Metadata Document (client_id=https://claude.ai/oauth/claude-code-client-metadata). By default Claude Code requests every scope the MCP server lists, write scopes included; for narrower access, use a personal API token (see Other MCP apps).

ChatGPT

ChatGPT accounts with Developer mode enabled can add a custom MCP connector: URL https://api.tino.vn/mcp, OAuth authentication. The exact steps depend on the version of the ChatGPT interface.

Other MCP apps (Cursor, VS Code, n8n…)

Main option: OAuth sign-in. An MCP client that supports OAuth as the MCP specification describes registers itself with Tino, then opens the sign-in page; you only enter the URL https://api.tino.vn/mcp, with no client ID, secret or header:

1. Calling https://api.tino.vn/mcp without a token returns HTTP 401; the WWW-Authenticate header points to the metadata at https://api.tino.vn/.well-known/oauth-protected-resource.
2. The client reads the discovery document https://api.tino.vn/.well-known/oauth-authorization-server and registers itself at the registration_endpoint (POST https://api.tino.vn/oauth/register, RFC 7591): a public client (token_endpoint_auth_method: none) redirecting to http://localhost or 127.0.0.1 (any port) or https://. Field rules are in Sign in from a CLI.
3. The client opens the Tino sign-in page (Authorization Code + PKCE, see Sign in with Tino); the customer approves as described in Signing in and granting access.

On the Authorized apps page, a self-registered app appears under the name it registered (client_name).

Alternative: personal API token. Use it when the app does not support MCP OAuth, runs on a server that cannot open a browser, or needs narrower scopes or an IP restriction:

1. Create a token at https://auth.tino.vn/en/me/security, in the API tokens section: choose exactly the scopes you need; if the app runs on a fixed server, restrict the token to its IP. See Personal API tokens.
2. Configure the MCP server in the app: URL https://api.tino.vn/mcp, header Authorization: Bearer <token>. A common JSON configuration format:

{
  "mcpServers": {
    "tino": {
      "type": "http",
      "url": "https://api.tino.vn/mcp",
      "headers": { "Authorization": "Bearer tinopat_…" }
    }
  }
}

The token is a key to the account: do not paste it into the chat, do not commit it to Git; if it leaks, revoke it immediately on the API tokens page.

Signing in and granting access

When you connect, the browser opens a Tino page: the customer signs in as usual (OTP code by email or phone number, Google, Zalo or passkey), reviews the list of scopes the app requests, then clicks Approve. The app receives a time-limited access token (24 hours by default) and a refresh token to renew it automatically; if the refresh token is not used before it expires (30 days by default), the customer must reconnect.

Approving grants every scope in the list. For narrower access, use a personal API token with only the scopes you need.

Scopes and tools

Each tool is a route of the /v1 gateway (see Calling the Tino API); a tool's description ends with its route and scope, for example GET /details · scope profile:read. tools/list returns only the tools the token can call, so the assistant does not see tools outside the granted scopes.

Tools with a read scope carry the annotation readOnlyHint: true; tools with a write scope carry destructiveHint: true. The tools for email forwarding, domain forwarding, registering private nameservers and getting payment content from a payment gateway also carry openWorldHint: true (they affect external systems).

Not available through MCP

• Cancelling services: only on the Tino customer control panel; MCP has no cancel tool, even when the token has the service management scope.
• Getting the domain transfer code (EPP), changing the domain registrant: never granted to Claude, ChatGPT or any OAuth app. Only a personal API token with the domains:owner scope (IP restriction required) has these two tools; choose that scope only when you really need it.
• Creating TinoPay API tokens, linking receiving bank accounts: likewise, only a personal API token with the tinopay:owner scope (IP restriction required) has these tools.
• Ordering new hosting or VPS: not supported yet. Ordering domains and SSL certificates is supported.

Example requests

• "List my Tino services and their renewal dates."
• "Which nameservers does example.vn use?"
• "Add an A record www pointing to 203.0.113.10 for example.vn."
• "Do I have any unpaid invoices?"
• "Restart the VPS with hostname web01." (write action: the assistant should ask for confirmation first)

Safety and data

• Every change (orders, renewals, payments, DNS or nameserver changes, VPS restarts) is marked as a write action; the MCP server also tells the assistant to state what it will do and wait for the customer's approval. The confirmation step is done by Claude or ChatGPT according to the app's settings: keep the ask-before-running mode on and read the details carefully before approving.
• The assistant only reads and writes through Tino's API within the granted scopes; results are sent to Claude or ChatGPT to answer the customer.
• The MCP server filters identity fields out of every person record (objects with email plus firstname, lastname or name: accounts, contacts, domain registrants) before sending them to the assistant: ID document numbers, date of birth, gender, phone number, address, tax code, household business code, bank, Zalo link, IP and sign-in times. Calling the /v1 gateway directly returns the response unchanged (see Calling the Tino API).
• Privacy policy · Terms of use.

Revoking access

The customer goes to https://auth.tino.vn/en/me/apps (Authorized apps) and clicks Revoke on "Claude", "Claude Code", "ChatGPT" or the name of a self-registered MCP app: every token of that app stops working immediately. Personal API tokens are revoked at https://auth.tino.vn/en/me/security, in the API tokens section.

Troubleshooting

For MCP client developers

Try it with a personal API token ($TINO_TOKEN). Each message is one JSON-RPC 2.0 POST; with no token or a wrong token you get HTTP 401 with the header WWW-Authenticate: Bearer error="invalid_token", scope="…", resource_metadata="https://api.tino.vn/.well-known/oauth-protected-resource" so the client can start OAuth.

curl -X POST https://api.tino.vn/mcp \
  -H "Authorization: Bearer $TINO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/list"}'

Calling a tool: the route's path parameters are required arguments; other arguments go into the query (GET, DELETE) or the body (POST, PUT).

curl -X POST https://api.tino.vn/mcp \
  -H "Authorization: Bearer $TINO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": {"name": "service_details", "arguments": {"id": "100001"}}}'

• Supported methods: initialize, ping, tools/list, tools/call; messages without an id (notifications) get HTTP 202.
• The result of tools/call is the route's response: JSON as text, with isError: true when the route reports an error (HTTP 4xx, 5xx or an error field); files (for example invoice PDFs) are returned as an embedded base64 resource.
• Tool names are lowercase with underscores (get_details, service_details, dns_add_record…) and may change when the API adds routes; get the list with tools/list instead of hard-coding it.