MCP assistants

Connect an assistant

Lymi speaks the Model Context Protocol, so an assistant can work with your decks inside a conversation. It signs in as you, over OAuth, and never sees an API key.

One endpoint

MCP server URL

https://my.lymi.app/mcp

It is a streamable HTTP endpoint. There is no local process to install, no npx command and no config file holding a secret.

How signing in works

The assistant asks, and is turned away
Its first request has no token, so Lymi answers 401 with a WWW-Authenticate header naming where to go next. The assistant follows that metadata to sign in. Some clients also need the public client ID in their setup guide.
It finds the authorization server
The header points at /.well-known/oauth-protected-resource/mcp, which names Lymi’s own authorization server. Lymi is both the resource and the issuer, so there is no third party in the middle.
You sign in and choose
Your browser opens on Lymi’s sign-in, then on a consent screen naming the assistant and what it is asking for. You can untick write before you agree. Whatever you leave ticked is what the token carries.
The assistant gets a token
Bound to https://my.lymi.app/mcp and to the scopes you approved. With offline_access it also gets a refresh token, so you are not asked again every hour.

Scopes

read: List and read decks, cards, the queue and settings.
write: Also add, edit, archive and restore. Untick it to keep the assistant read-only.
offline_access: A refresh token, so the connection survives longer than an hour.

The scope on the token is what counts, not what the assistant asked for. Removing write at the consent screen means every write it attempts is refused, with a message telling it to ask you to reconnect.

Disconnect an assistant from its page under Settings → Apps and its next request is refused, even if its token has not expired. It has to ask you again.

What a connected assistant can do

Tools for decks, cards, organization and learning progress. The assistant reads their descriptions, so you rarely name one yourself: ask it to add the cards from a lesson, and it finds the deck and calls add_cards.

list_decks: Every active deck with its card and due counts, the language your meanings are written in, and how each deck language writes a pronunciation and an example.
get_deck: One deck's summary: its card, due and stage counts, and the terms of its 15 newest cards. For every card, page through search_cards.
create_deck: A new deck, with a default language for the cards added to it.
update_deck: Rename a deck, change its description, language or directions, or move it into or out of a series.
archive_deck, restore_deck: Hide a deck and its cards, and bring them back.
list_series, create_series, update_series, reorder_series: Your series: ordered groups of your own decks that you review together. Create one, rename it, set its decks in order, or reorder them all.
delete_series: Delete a series for good, archiving its decks with it or leaving them in Library.
list_sections, create_section, rename_section, reorder_sections, move_cards_to_section: A deck's sections: ordered parts such as one lesson each, which learners open in order. Create one, rename it, reorder them, or move many cards in or out at once.
archive_section, restore_section: Hide a section, with its cards or leaving them in the deck, and bring it back.
list_deck_tags, rename_tag, archive_tag, restore_tag: A deck's tags: rename one, merge it into another by renaming onto its name, or archive it from the deck's cards and bring it back. Each acts on one deck; other decks keep their tags. Put tags on cards with update_cards.
search_cards: Cards matching text, one exact term, a deck or an active section, or a filter on any card field and on your own review history, such as the cards you forgot most this month. Sorted, with each card's review record on request. Can look through archived cards. Results come a page at a time: pass nextCursor back as cursor until it is null, since a page can be short or even empty. total is null when it is not known exactly.
get_card: One card, with everything written on it.
add_cards: One or many cards in a call. A duplicate is skipped, never rejected, and the result names the existing card.
update_card, update_cards: Change fields on one card or up to 200, or move them to another deck. In a bulk edit, each card succeeds or fails on its own and the result says which.
archive_card, archive_cards, restore_card, restore_cards: Hide one card or up to 200, and bring them back, schedule intact.
enrich_card: Ask Lymi to fill a card's empty meaning, example, pronunciation and language.
due_counts: How many cards are waiting, in total, per deck and per series, and how many are in each Today round: forgotten today, new and slipping.
get_settings, update_settings: The language your meanings are written in. Reading also returns your daily goal, which only you can change.
get_insights: Recall rate, days reviewed, cards by stage, the week ahead, and the cards that keep coming back.
get_streak: Today against your daily goal, days in a row that met it, the longest run, and every day with a review.

The assistant does the extraction. It reads the lesson you share, decides which terms are worth a card and sends them in one batch. It says which fields it took from the lesson; anything it composed itself is recorded as yours, and Activity shows the app that sent it. Lymi fills the empty meaning, example, pronunciation and language only on cards the assistant sends with enrich: true, or later with enrich_card, and that text alone is labelled ai on the card. Nothing already on a card is overwritten.

Lymi receives the fields the assistant submits, not the rest of the conversation or raw lesson material unless it is included in a field. Read the privacy policy for how connected-app data is handled and MCP support if the connection does not complete.

What a connected assistant can never do

Grade a review. Only you, in the app, whatever the token holds.
Touch your API keys. Keys are session-only, so an MCP token cannot list, mint or revoke one.
Delete your account. Account deletion stays in the app. Cards, decks and sections are archived and can be restored. Deleting a series is permanent; its decks can stay in Library or be archived with it.

Everything it does add carries createdBy: "mcp" and lands in the audit log with the same actor, so you can always tell what came from a conversation.

What the client has to support

Lymi uses OAuth with client metadata and PKCE. Check these requirements if a custom MCP client cannot connect:

Client ID Metadata Documents. A client identifies itself with an HTTPS URL that serves its own metadata. Dynamic client registration is switched off in Lymi. Use a client’s metadata URL or the public client ID from its Lymi setup guide.
PKCE with S256. The only code challenge method Lymi accepts.