Aloi · Product overview
A secure bridge that lets AI assistants — Claude, ChatGPT, Codex, and any other Model Context Protocol client — search and read your firm's Aloi Knowledge Base, authenticated with your own Microsoft account.
The Model Context Protocol (MCP) is an open standard that lets AI assistants use external tools. The Aloi MCP Server implements that standard for the Aloi Knowledge Base: once connected, your assistant can search your firm's documents, read them in full, and see what the knowledge base covers — all inside a conversation, with your firm's permissions enforced.
| Tool | What it does |
|---|---|
ask_aloi | Ask a question to the Aloi agent and get answers grounded in your firm's documents, with direct access to relevant sections in your sources. |
ask_aloi_result | Check a background Knowledge Base answer job for completion and citations. |
describe_aloi_knowledge_base_schema | Lists the document-type labels and metadata fields (with allowed values) accepted by the search and inspect filters. |
inspect_aloi_knowledge_base | Reports counts, facet distributions, and coverage — a map of what's in the library. |
read_aloi_knowledge_base_documents | Loads one to five documents in full for close reading. |
search_aloi_knowledge_base | Hybrid semantic + keyword search across the knowledge base; returns candidate documents. |
Tool descriptions and argument schemas are served live by the knowledge base itself, so what your assistant sees is always current — no stale, hand-maintained copies.
Every client firm gets its own dedicated MCP server instance, bound to that firm's own Microsoft Entra tenant and its own knowledge base. Isolation is physical, not a filter.
Sign-in is your firm's normal Microsoft login. Every request carries a Microsoft Entra token that is cryptographically verified — signature, issuer, and audience — before anything is served.
The service never stores user tokens — your MCP client holds and refreshes them. In production the service authenticates to Microsoft with workload identity, so there is no client secret to store or leak.
The server is a thin, verified relay: it forwards your assistant's request to the knowledge base and returns the answer. Documents are not copied, cached, or retained by the connector.
You receive a dedicated HTTPS URL when the MCP server is installed for your firm. Add it to your client as a streamable-HTTP MCP server — no client id, secret, or token to configure.
On first use, the server responds with standard OAuth discovery information (RFC 9728 / RFC 8414). Your client opens your firm's familiar Microsoft sign-in, using the industry-standard authorization-code flow with PKCE.
A central authorization service handles the handshake between your client and Microsoft, then steps out of the way. It validates where login results may be sent (protecting against redirect attacks) and keeps nothing afterwards.
The access token lives in your MCP client, which refreshes it automatically — sign in once and stay connected. Access tokens are short-lived; refresh happens silently in the background.
Each tool call presents the token to your firm's dedicated server, which verifies it against Microsoft's published signing keys before forwarding the request to the knowledge base under your identity.
claude mcp add --transport http aloi https://<your-tenant-host>/mcp --callback-port 7777 — pick any free port on your machine.
Open Settings → Connectors → Add custom connector, enter a name and your server URL, and complete the Microsoft sign-in. Leave the optional OAuth client id and secret blank.
Enable Developer mode under Settings → Connectors → Advanced (a workspace admin may need to allow this), then create a connector with your server URL, choosing OAuth.
codex mcp add aloi --url https://<your-tenant-host>/mcp, then codex mcp login aloi to open the Microsoft sign-in.