Integration

MCP Server

Connect AI clients like Claude, ChatGPT, Cursor, and VS Code to Frontier HSA with OAuth 2.1.

Use Frontier HSA's remote MCP server to let AI clients read account data and take actions on your behalf.

Getting started

Use this endpoint in clients that support remote MCP:

https://mcp.frontierhsa.ca/mcp

OAuth discovery metadata:

https://mcp.frontierhsa.ca/.well-known/oauth-authorization-server

Setup instructions

General

If your client supports remote MCP over HTTP, use:

https://mcp.frontierhsa.ca/mcp

If your client only supports stdio MCP, use mcp-remote:

npx -y mcp-remote https://mcp.frontierhsa.ca/mcp

Claude

Team and Enterprise (Claude.ai)

  1. Open Claude Settings.
  2. Go to Integrations and add a custom integration.
  3. Name it Frontier HSA.
  4. Set URL to https://mcp.frontierhsa.ca/mcp.
  5. Start a new chat and enable tools.

Free and Pro (Claude Desktop)

Update claude_desktop_config.json:

{
  "mcpServers": {
    "frontier-hsa": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://mcp.frontierhsa.ca/mcp"]
    }
  }
}

Restart Claude Desktop, then complete OAuth in browser.

Claude Code

Add the server to your user config so it's available across all projects:

claude mcp add --transport http --scope user frontier-hsa https://mcp.frontierhsa.ca/mcp

Then run /mcp in session and authorize in browser.

Cursor

Open Cursor Settings > MCP Tools and add a new global server:

{
  "mcpServers": {
    "frontier-hsa": {
      "url": "https://mcp.frontierhsa.ca/mcp"
    }
  }
}

Visual Studio Code

Open your user settings.json and add the server so it's available across all workspaces:

{
  "mcp": {
    "servers": {
      "frontier-hsa": {
        "type": "http",
        "url": "https://mcp.frontierhsa.ca/mcp"
      }
    }
  }
}

Windsurf

Add this to your Windsurf MCP config (~/.codeium/windsurf/mcp_config.json):

{
  "mcpServers": {
    "frontier-hsa": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://mcp.frontierhsa.ca/mcp"]
    }
  }
}

This persists across all Windsurf sessions.

Zed

Add this to your Zed settings (~/.config/zed/settings.json) so the server is available in every Zed session:

{
  "context_servers": {
    "frontier-hsa": {
      "command": {
        "path": "npx",
        "args": ["-y", "mcp-remote", "https://mcp.frontierhsa.ca/mcp"],
        "env": {}
      },
      "settings": {}
    }
  }
}

Codex / ChatGPT clients

For clients with direct URL support, configure:

https://mcp.frontierhsa.ca/mcp

Codex CLI adds the server to your user context automatically:

codex mcp add frontier-hsa --url https://mcp.frontierhsa.ca/mcp

Others

Use this bridge command:

npx -y mcp-remote https://mcp.frontierhsa.ca/mcp

Then complete OAuth login and verify tools load.

OAuth behavior

  1. The client initiates OAuth and may register as an OAuth client.
  2. You sign in with your Frontier HSA account.
  3. Authorization returns to your MCP client.
  4. The client stores and refreshes tokens automatically.

Available tools

The Frontier HSA MCP server exposes 11 tools.

Read tools

  • get_profile
  • get_tax_savings
  • get_user_analytics
  • list_claims
  • get_claim
  • list_notifications

Action tools

  • analyze_receipts
  • submit_claim
  • withdraw_claim
  • mark_notification_read
  • mark_all_notifications_read

For claim submission, call analyze_receipts first and then pass its extracted values and storageUrl into submit_claim.

Example prompts

  • "How much have I been reimbursed this year?"
  • "Show me my pending claims"
  • "Analyze this receipt and prepare a claim draft"
  • "Submit this analyzed receipt as a claim"
  • "What are my estimated tax savings so far?"
  • "Show unread notifications only"

Security

  • OAuth 2.1 + PKCE is used for secure authorization.
  • Tokens expire and are refreshed by the client.
  • Access is scoped to the authenticated Frontier HSA user.
  • Monetary values are handled in cents to avoid rounding drift.

Need help?

If you run into issues, contact hello@frontierhsa.ca or visit the contact page.

FAQ

Why does authentication keep failing?+

Make sure your MCP client opens a browser for OAuth, then complete login with your Frontier HSA account. If you previously denied access, remove the old server entry from your MCP client and reconnect.

Do you support Streamable HTTP?+

Yes. Use https://mcp.frontierhsa.ca/mcp. This is the recommended transport for clients that support remote MCP natively.

Can I use SSE instead of Streamable HTTP?+

Our documented and supported endpoint is the remote MCP endpoint at /mcp with OAuth 2.1. If your client only supports stdio, use an MCP bridge client that can proxy remote MCP servers.

What permissions does the MCP server get?+

Access is scoped to the authenticated Frontier HSA user. The assistant can only call tools that your account is allowed to use.