Thridy over MCP

1. 1

   Be on a paid plan

   MCP is included on every paid plan. See the plans.

2. 2

   Using Claude in the browser, Desktop or mobile?

   Add https://mcp.thridy.com as a custom connector and sign in to Thridy when it asks. No token, nothing to copy. Details in section 4.

3. 3

   Using Claude Code, Cursor or another client?

   Create a token at thridy.com/account/mcp and add the server with one command or one JSON block. Section 5 has the exact text for each client.

4. 4

   Ask for an icon

   “Find me a rocket icon and add it to the slide.” Your agent searches, picks, and fetches.

https://mcp.thridy.com

Streamable HTTP, POST only, stateless. Protocol revisions 2025-06-18, 2025-03-26 and 2024-11-05 are accepted. There is no SSE stream and no session id; each request is answered in full.

Send your token as a Bearer token in the Authorization header on every request. Tokens start with thmcp_, are stored hashed on our side, and can be revoked at any time from the same page that made them.

There are two ways to get one. Claude in the browser, Desktop and mobile use OAuth: the server answers every request without a token with HTTP 401 and a WWW-Authenticate header, Claude reads it, and sends you to thridy.com to sign in and approve. Nothing to copy. Every other client takes the token from your account page in the Authorization header.

Every request needs a token, initialize included. That is deliberate: a client probing the server has to learn on its first call that sign-in is required, or it concludes the server is open and never offers to sign you in. Without a token you get HTTP 401 and this, verbatim:

MCP access needs a Thridy token from a paid plan (Designer or Studio), see https://thridy.com/pricing. Create one at https://thridy.com/account/mcp, or connect through Claude and sign in when it asks.

For OAuth clients the discovery documents are at https://mcp.thridy.com/.well-known/oauth-protected-resource and https://thridy.com/.well-known/oauth-authorization-server. PKCE (S256) is required, public clients only, and both Client ID Metadata Documents and dynamic registration are supported.

No token and nothing to paste. Claude signs you in to Thridy and keeps the connection itself.

1. 1

   Add the connector

   In Claude, open Customize, then Connectors, then Add custom connector. Name it Thridy and enter https://mcp.thridy.com.

2. 2

   Leave the detected settings

   Authentication shows Always required and the OAuth client is detected. Both are right. Add no headers.

3. 3

   Sign in and approve

   Claude sends you to thridy.com. Sign in if you are not already, read what the connection can do, and press Connect. You are sent straight back.

4. 4

   Ask for an icon

   “Find me a rocket icon.” Claude searches the library and fetches the PNG for you.

To disconnect, remove the connector in Claude, or revoke it at thridy.com/account/mcp, where it appears as a token named Claude connector. Revoking stops it immediately.

Replace thmcp_YOUR_TOKEN with yours. If you create the token first, the token page shows each of these with the real value in place.

claude mcp add --transport http thridy https://mcp.thridy.com --header "Authorization: Bearer thmcp_YOUR_TOKEN"

{
  "mcpServers": {
    "thridy": {
      "url": "https://mcp.thridy.com",
      "headers": { "Authorization": "Bearer thmcp_YOUR_TOKEN" }
    }
  }
}

{
  "mcpServers": {
    "thridy": {
      "command": "npx",
      "args": ["mcp-remote", "https://mcp.thridy.com", "--header", "Authorization:${AUTH_HEADER}"],
      "env": { "AUTH_HEADER": "Bearer thmcp_YOUR_TOKEN" }
    }
  }
}

curl -X POST https://mcp.thridy.com \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer thmcp_YOUR_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"search_icons","arguments":{"query":"rocket","limit":3}}}'

Results are lean JSON carrying URLs, never image bytes. Every result includes the icon’s thridy.com page and the license line, so an agent always knows where an icon came from and what it may do with it.

The three limits are separate on purpose. Calls a minute and requests in flight are retryable, and the error says when to try again, so a well-behaved agent waits rather than giving up. The download allowance is shared with the website, and a separate guard of 60 downloads a minute per account sits on top of it, which is an abuse guard rather than part of any plan.