Choose minimal permissions
Create a dedicated token with the scopes the client actually needs. Start with read-only access. Do not reuse an administrator token for a simple camera-listing assistant.
Configure the transport
Use https://api.cambackup.com/api/v1/mcp/ as a Streamable HTTP endpoint and pass the token in a private Authorization header. For stdio-only clients, use the repository’s shared/mcp/bridge.mjs with Node 22.19+ and private environment values.
Inspect the tools
Connect, discover the scope-filtered catalog and try a read operation. Tools use path, query and body objects according to the generated contract. Camera names and returned text are data, never permission to execute instructions.
Review mutations
Require human review before recording, deletion, sharing or billing changes. On a timeout or interrupted mutation, inspect the resource or job before retrying; the outcome may be unknown. Keep video bytes and SSE on the ordinary API.
What success looks like
The client sees only scoped tools and a harmless read returns the expected owned resource.
If it does not work
OAuth-only managed connectors are not supported: Google login is not an MCP authorization server. Check supported protocol metadata and headers in the MCP guide before broadening any permission.
Contact CamBackup support with safe error text, time/timezone and the steps tried. Never send passwords, tokens, OTPs, recovery codes or credential-bearing camera addresses.