Assistants

Connect an assistant

Lymi speaks the Model Context Protocol, so an assistant can work with your decks inside a conversation. It signs in as you, over OAuth, and never sees an API key.

One endpoint

MCP server URL

https://my.lymi.app/mcp

It is a streamable HTTP endpoint. There is no local process to install, no npx command and no config file holding a secret.

How signing in works

The assistant asks, and is turned away
Its first request has no token, so Lymi answers 401 with a WWW-Authenticate header naming where to go next. That header is the whole handshake: nothing is configured by hand.
It finds the authorization server
The header points at /.well-known/oauth-protected-resource/mcp, which names Lymi’s own authorization server. Lymi is both the resource and the issuer, so there is no third party in the middle.
You sign in and choose
Your browser opens on Lymi’s sign-in, then on a consent screen naming the assistant and what it is asking for. You can untick write before you agree. Whatever you leave ticked is what the token carries.
The assistant gets a token
Bound to https://my.lymi.app/mcp and to the scopes you approved. With offline_access it also gets a refresh token, so you are not asked again every hour.

Scopes

read: List and read decks, cards, the queue and settings.
write: Also add, edit, archive and restore. Untick it to keep the assistant read-only.
offline_access: A refresh token, so the connection survives longer than an hour.

The scope on the token is what counts, not what the assistant asked for. Removing write at the consent screen means every write it attempts is refused, with a message telling it to ask you to reconnect.

Disconnect an assistant under Settings → Connected apps and its next request is refused, even if its token has not expired. It has to ask you again.

What a connected assistant can do

The same surface as the API, less review grading. The assistant reads their descriptions, so you rarely name one yourself: ask it to add the cards from a lesson, and it finds the deck and calls add_cards.

list_decks: Every active deck with its card and due counts, plus the language your meanings are written in.
get_deck: One deck and its cards, newest first, up to 200.
create_deck: A new deck, with a default language for the cards added to it.
update_deck: Rename a deck, change its description, language or directions, or move it into or out of a series.
archive_deck, restore_deck: Hide a deck and its cards, and bring them back.
list_series, create_series, update_series, reorder_series: Your series: ordered groups of your own decks that you review together. Create one, rename it, set its decks in order, or reorder them all.
archive_series, restore_series: Hide a series, with its decks or leaving them in Library, and bring it back.
list_sections, create_section, rename_section, reorder_sections, move_cards_to_section: A deck's sections: ordered parts such as one lesson each, which learners open in order. Create one, rename it, reorder them, or move many cards in or out at once.
archive_section, restore_section: Hide a section, with its cards or leaving them in the deck, and bring it back.
search_cards: Cards matching text in the term, meaning, example or notes. Can look through archived cards.
get_card: One card, with everything written on it.
add_cards: One or many cards in a call. A duplicate is skipped, never rejected, and the result names the existing card.
update_card: Change fields on a card, or move it to another deck.
archive_card, restore_card: Hide a card and bring it back, schedule intact.
due_counts: How many cards are waiting, in total, per deck and per series, and how many are in each Today round: forgotten today, new and slipping.
get_settings, update_settings: The language your meanings are written in. Reading also returns your daily goal, which only you can change.
get_insights: Recall rate, days reviewed, cards by stage, the week ahead, and the cards that keep coming back.
get_streak: Today against your daily goal, days in a row that met it, the longest run, and every day with a review.

The assistant does the extraction. It reads the lesson you share, decides which terms are worth a card and sends them in one batch. A meaning, example or pronunciation it wrote itself is labelled ai on the card, so you can always tell its text from the lesson’s. Lymi then fills whatever is still empty — meaning, example, pronunciation and language — and labels that text ai too. Nothing already on a card is overwritten.

Lymi receives the fields the assistant submits, not the rest of the conversation or raw lesson material unless it is included in a field. Read the privacy policy for how connected-app data is handled and MCP support if the connection does not complete.

What a connected assistant can never do

Grade a review. Only you, in the app, whatever the token holds.
Touch your API keys. Keys are session-only, so an MCP token cannot list, mint or revoke one.
Delete anything. Archive and restore are the only two, and both are reversible.

Everything it does add carries createdBy: "mcp" and lands in the audit log with the same actor, so you can always tell what came from a conversation.

What the client has to support

Lymi follows the MCP authorization spec of 28 July 2026. Two things follow, and both can stop a client connecting:

Client ID Metadata Documents. A client identifies itself with an HTTPS URL that serves its own metadata. Dynamic client registration is deprecated by that spec and is switched off here, so a client that only knows how to register dynamically cannot connect.
PKCE with S256. The only code challenge method Lymi accepts.