Connecting an AI client
Ragextract speaks the Model Context Protocol, so an AI client can read your workspaces, tables and extracted answers directly. A connection reaches one organisation, and never more of it than you can already see yourself.
Connecting
Point an MCP client — Claude, Cursor, or an agent somebody on your team wrote — at https://mcp.ragextract.com. The client sends you to Ragextract to sign in, and then asks which organisation it may reach. Approve it and the client is connected.
There is no key to copy and nothing to paste. The connection is made by signing in, which is also why it can be withdrawn from inside the app rather than by rotating a secret.
One connection reaches one organisation. If you belong to more than one, the client sees only the one you picked; to reach a second, authorize the client again and choose the other. There is no cross-organisation tool and no way to ask a connected client what else you belong to. See organisation settings.
What a connected client can read
Eleven tools, and the names below are the ones your owners and admins see in settings. Everything except the last is a read of data the app is already showing you.
| Tool | What it reaches |
|---|---|
| List workspaces | The workspaces you can reach, with your permission level in each. |
| Get workspace | Details of one workspace. |
| List files | Files in a workspace, with page counts and ingestion status. |
| Get file | Details of one file. |
| Read file pages | Short-lived links to page images. Grants sight of the original documents. |
| List tables | Extraction tables in a workspace. |
| Get table | One table with its columns, including each column’s prompt. |
| Read table rows | The rows of a table and which file each extracts from. |
| Read table cells | The extracted values themselves, with citations and confidence. |
| List jobs | Ingestion jobs for a workspace and their status. |
| Search documents | Semantic search across a workspace’s documents. Costs credits — see below. |
Pages come back as pictures, not text
Asking for the pages of a file returns a short-lived link to each page image, not the words on it. That is not a limitation of the connection: Ragextract stores pages as images and reads them when a column asks a question, so there is no plain-text copy of a document to hand over. The text you want is almost always the extracted answers — read table cells — which come with the citation that says which page each one came from.
Page links expire after ten minutes, and are handed out a page range at a time rather than a whole document at once. A client that wants page 40 should ask for pages 40 to 45, not for all 300.
Two limits apply, and neither replaces the other
A connected client acts as you, and is bounded twice.
- What you can reach. Every tool is scoped to the workspaces shared with you, at the level they were shared at. A workspace you cannot open in the browser does not exist as far as the client is concerned, and connecting one has never granted anybody a level they did not already hold.
- What your organisation allows. Owners and admins set settings → MCP tools, a grid of the four organisation roles against the tools each may call. By default every role gets every tool.
The order matters, because it is the thing most likely to be read backwards. The tools grid can only ever take access away. Ticking a box does not expose a document to somebody who could not already open it; it only decides whether they may reach it this way as well as in the browser. Clearing one does not make data private again if the person can still read it in the app.
One consequence worth knowing before you edit that grid: once an organisation saves a tool policy, a tool we add later is off for that organisation until somebody ticks it. A saved policy is an exhaustive list, and we would rather a new capability arrive switched off than be granted by a decision made before it existed. Organisations that have never opened the page get new tools with the defaults.
Searching costs credits
Search is the one tool that spends. It costs $1 per 1,000 searches, charged a hundred at a time: a search that opens a new block of 100 takes 40 credits and the 99 after it take nothing at all. Every other tool is free.
It is billed like any other work — against the organisation’s balance, and counted toward the monthly spend cap if you have set one. A search is charged before its results come back, so a search that fails after being metered has still been counted. If the balance cannot cover a block, the client is told so in the tool’s own reply rather than being handed empty results.
This is the tool to think about before granting it. A person searches once and reads the answer; an agent searches, decides that was not quite it, and searches again — forty times, without being asked. The spend cap is the control that bounds this, and it is organisation-wide, so it is shared with everyone else’s work.
Managing and disconnecting
Settings → Connections lists every client you have connected: which client, which organisation, and when it last connected. It is the only place a connection is visible, because there is no key sitting in a file somewhere to remind you it exists.
Disconnect takes effect on the next call. The tokens are deleted then and there, and because nothing about a connection is cached, the client is locked out immediately. This is different from a personal API key, where revoking takes up to a minute — and a connection is not a personal key. They are different credentials, listed on different screens, and revoking one does nothing to the other.
Connections belong to the person who made them; each of you disconnects your own. Removing somebody from the organisation ends theirs, because access is resolved fresh on every call rather than remembered from when they connected.
What it does not do
- It reads; it does not write. No uploading, no creating or running a table, no editing a column, no overriding a cell. Nothing a client does can change what is in your workspaces.
- It adds no capability of its own. Every tool is something the product already does; nothing arrives over MCP first.
- It keeps no conversation. We store which client is connected, to which organisation, and when — not the questions the model asked.
- It is rate limited, at 120 requests a minute per connection. An agent in a loop is slowed rather than allowed to run.
What the client itself does with what it reads is between you and whoever makes it. Extracted answers and page images go to the client you connected, which is your tooling acting on your instruction — the same way your browser is.