Connect to Valid9 MCP

Connect your assistant

You need a Valid9 account with an enrolled authenticator, organization access, and an MCP client that supports Streamable HTTP and OAuth. Your client’s administrator may need to allow custom connectors.

Claude setup: Web · Desktop · Claude Code CLI.

1. In your client’s MCP or connector settings, add a remote server named Valid9.
2. Use this server URL:

https://mcp.valid9.com/mcp

3. Start the client’s connect or sign-in flow. Sign in to Valid9 in your browser and complete multi-factor authentication.
4. Review the consent screen. Choose read access, or allow writes if you want the assistant to create and edit supported records.
5. Return to your client and ask it to list your Valid9 organizations. Select the intended organization before working with records.

The transport is Streamable HTTP. Use browser authorization; you do not need to copy a password, API key or session token into your assistant.

Connect Claude (web)

Add Valid9 through Claude’s connector settings before asking it to use your records. Pasting the server URL into a conversation does not configure the connection.

1. Open Customize → Connectors in Claude. Some versions show Settings → Connectors.
2. Choose + Add → Add custom connector.
3. Enter the name and server URL for your environment:

4. Continue through setup using OAuth browser authorization, then add the connector and choose Connect if prompted. Sign in to the matching Valid9 environment, complete multi-factor authentication and review the requested access. Allow writes only if you want Claude to create or edit supported records.
5. In your chat, open + → Connectors and enable Valid9 (or Valid9 Staging). If it is missing, start a new chat and check again.
6. Ask Claude to list your Valid9 organizations, then choose the organization you want to work in.

Team and Enterprise: an owner or another authorized administrator must first add the connector under Organization settings → Connectors. Each member then connects their own account and enables it in a chat.

Keep production and staging connections separate and use the matching account; the environments hold different records. See Claude’s custom connector guide for current plan limits and setup screens.

Connect Claude Desktop

Sign in to Claude Desktop with the same account used on the web. Open Connectors and follow the web setup steps, or select your existing Valid9 connector. Connect your Valid9 account and enable the connector in the chat.

Valid9 is a hosted remote server. This setup does not require a local server, a desktop extension or editing claude_desktop_config.json. The same plan limits and organization policies apply.

Connect Claude Code CLI

With Claude Code installed, open /mcp inside a session first. If you use a Claude account, an authenticated web connector may already appear there. Use that connection, or add a direct HTTP connection from your terminal:

Production

claude mcp add --transport http --scope user valid9 https://mcp.valid9.com/mcp

Staging

claude mcp add --transport http --scope user valid9-staging https://mcp-staging.valid9.com/mcp

Run only the command for the environment you need, or keep both under their distinct names. --scope user makes the connection available across your projects on this computer; use --scope local to limit it to the current project.

1. Start or restart Claude Code with claude.
2. Enter /mcp, select valid9 or valid9-staging, and follow its authentication action.
3. Complete Valid9 sign-in, multi-factor authentication and consent in your browser, then return to Claude Code.
4. Check the connection in /mcp and ask it to list your Valid9 organizations before selecting one.

Use claude mcp list in your terminal to inspect configured servers. See the Claude Code MCP guide for installation scopes and authentication troubleshooting.

Start with a small question

Ask your assistant to name the organization and source records behind its answer. Treat record content as source material, and review proposed changes before asking the assistant to apply them.

Retained import jobs

Use valid9_list_import_jobs, valid9_get_import_job and valid9_import_job_history to inspect uploaded previews and results. With write consent, valid9_map_import_job creates a new preview using retained files, valid9_replan_import_job refreshes it, and valid9_apply_import_job applies the user-authorized expected_version. Explicitly accept any skips. No approvals, signatures or historical test executions are recreated. Jira import workflow and rollout notes.

The same list/get/history/replan/apply tools support Qualio and portable document imports. Mapping is Jira-only; corrected document inventories require a new app/CLI upload. Documents remain drafts and source approvals are not recreated.

Use your organization slug and record references

Ask the assistant to list your organizations first. The org argument accepts an organization slug or UUID. Requirement, parent, task, test, release and CAPA arguments accept their matching short IDs as well as UUIDs, including requirement filters and a draft release’s task list. A CAPA short ID supplies its team, so every CAPA tool’s capa argument accepts CAPA-7 without a team UUID.

For client developers, these are example tool names and arguments; replace acme and the references with your own records:

valid9_get_requirement
{"org":"acme","requirement":"REQ-12"}

valid9_resolve_reference
{"org":"acme","reference":"TR-19"}

valid9_get_capa
{"org":"acme","capa":"CAPA-7"}

valid9_search
{"org":"acme","query":"change control","kind":"uploaded_file","limit":10}

valid9_resolve_reference returns the UUID and navigation context for REQ, TASK, TEST, TR, REL and CAPA references, including archived runs; a CAPA resolves to its team. Short IDs ignore case. Always choose the organization explicitly: a reference belongs to that organization and never grants access.

A requirement or test short ID can supply its module; a task short ID can supply its team for edits. Conflicting explicit scope is refused. UUID-only calls keep their scope requirements; creating requirements and tasks still needs a module or team respectively. Other record types and nested assessment/import data keep their existing identifiers and schemas.

Search includes native references, imported keys, record text and imported document filenames and extracted text. For uploaded_file results, inspect index_status and file_coverage for incomplete extraction. Scanned images are not OCRed. Results identify the imported revision and do not establish document approval. See the search guide for filters and file coverage.

These arguments require an updated MCP server in the selected environment. Older servers still accept UUIDs. Existing permissions, write consent and version checks apply to both forms.

What the connection can do

Reading tools work with read access. Writing tools run only if you allowed writes, and remain subject to your role and the record’s workflow rules.

Personal decisions stay with you in Valid9, never through an app: signing; completing test runs; affirming that a stale test run’s evidence still holds, or moving a stale draft run; recording system validation results; approving tasks, which happens when a task moves into a sprint; submitting, approving or rejecting supplier and system assessments and plans; deciding reviews; classifying and publishing releases; generating, sending, approving or rejecting release deliverables; sending, approving, rejecting or retiring controlled documents and SOPs; submitting a CAPA plan, completing a CAPA action and the reviewer’s CAPA decisions; completing or cancelling training; changing members and connecting apps.

A reason is optional on most writing tools. When you give one, the audit trail keeps it with you and the connected app; without one, it records what was done. Four tools require a reason: starting a revision of an approved or effective document, revising a CAPA’s approved plan, and retiring or restoring a shared resource. A CAPA comment is its own text.

Nothing can be deleted. Version checks prevent silently overwriting a newer revision. Read the existing records before creating another.

For test runs, see completion and retention in the app, including the passed-only list shortcut and handling failed or blocked results. The shortcut does not add a completion tool or broaden an assistant's permissions. No tool corrects a completed run or adds its evidence: the person who performed the run does that in Valid9 or with v9 runs correct and v9 runs evidence add, confirmed at their terminal.

No tool returns or accepts file bytes. Deliverable PDFs, release inspection packages, exports, import archives, run evidence and attachments are read as metadata and text. Upload source files through the app or CLI. Attach and download test-run evidence files in the app or with v9 runs evidence. For Jira and document imports, MCP can then inspect retained previews, revise Jira mappings, refresh previews and apply an explicitly reviewed version with write consent; it never receives the files. Interactive Jira authorization remains in the app. Use v9 for exports and controlled copies and for imports.

Shared display order and release archives

With write consent, authors and administrators can use valid9_organize_release to archive, restore or reorder a draft or published release. Read release_organization.version from valid9_list_releases first. Pass either archived or before_id, never both. An empty before value moves to the end.

valid9_organize_release
{"org":"acme","release":"REL-3","before_id":"REL-1","expected_version":0}

valid9_requirement_order
{"org":"acme","module":"MODULE_UUID"}

valid9_move_requirement
{"org":"acme","requirement":"REQ-12","before_requirement":"REQ-4","expected_version":0}

Use valid9_task_order with team and valid9_move_task with task and before_task for task ordering. All moves use the scoped list’s version, not the record revision; read and review again on conflict. Requirement targets must belong to the same module and task targets to the same team. Short IDs can infer the source scope; UUIDs require it explicitly.

Release create/update tools also accept description: omitted preserves it, empty clears it. Descriptions are signed content; published corrections stay in the app. Archive and ordering only change audited presentation metadata. They preserve signatures, revisions, failures and evidence; archiving a release does not archive its runs. Archived releases remain discoverable with search’s archived filter. App behavior and CLI equivalents.

Manage access

Valid9 checks your active membership and the connection’s consent on each request. To revoke the connection, open Security in Valid9, find Connected apps and revoke the relevant app. Removing a server from your assistant’s settings is a separate action.

A connected app stays signed in within the same session limits as the Valid9 app. It refreshes its access without asking you, but after about an hour without use, or 12 hours after you connected it, you need to sign in again. Revoking a connected app takes effect at once.

For staging, use a separate connection to https://mcp-staging.valid9.com/mcp and your staging account. Staging and production hold different records.

If something goes wrong

Send connection issues to hello@valid9.com. Include client version, time and error text, with credentials and private record content removed.