# OpenAI API and Anthropic API

Use the MCP as a remote tool from your code: OpenAI Responses and Anthropic Messages.

Guide Python · TypeScript Secret key

**Before you start.** Both APIs call the MCP from the provider’s servers, so the server must be public (it is) and your key travels on every request: create it with read permissions only and keep it in a backend environment variable. Read-only secret keys come with Business and Enterprise.

## OpenAI API (Responses)

An mcp tool with server_url and the key in headers. allowed_tools limits which tools the model sees; with require_approval "never" you don’t approve each call (all are reads). The response carries an mcp_list_tools item with the tools and an mcp_call per query.

Python:

```python
import os
from openai import OpenAI

client = OpenAI()
resp = client.responses.create(
    model="gpt-6-astra",
    tools=[{
        "type": "mcp",
        "server_label": "bydomu",
        "server_description": "CRM inmobiliario ByDomu, solo lectura",
        "server_url": "https://mcp.bydomu.com/mcp",
        "headers": {"Authorization": "Bearer " + os.environ["BYDOMU_API_KEY"]},
        "allowed_tools": ["search_properties", "get_property", "list_appointments"],
        "require_approval": "never",  # las 9 herramientas son de solo lectura
    }],
    input="¿Qué apartamentos en arriendo tengo en Medellín por menos de 4 millones?",
)
print(resp.output_text)
```

JavaScript:

```js
import OpenAI from "openai";

const client = new OpenAI();
const resp = await client.responses.create({
  model: "gpt-6-astra",
  tools: [{
    type: "mcp",
    server_label: "bydomu",
    server_url: "https://mcp.bydomu.com/mcp",
    headers: { Authorization: `Bearer ${process.env.BYDOMU_API_KEY}` },
    require_approval: "never",
  }],
  input: "Dame un resumen de la inmobiliaria.",
});
console.log(resp.output_text);
```

If you’d rather approve by hand, use require_approval "always": an mcp_approval_request arrives and you answer with an mcp_approval_response in the next request (with previous_response_id). The authorization field is for OAuth tokens; for the ByDomu key use headers. The model is the one in OpenAI’s examples: use whichever you prefer.

## Anthropic API (Messages)

The Messages MCP connector needs two parts and the mcp-client-2025-11-20 beta header: the server in mcp_servers (the key goes in authorization_token and is sent as Authorization: Bearer) and an mcp_toolset in tools that names it. The response carries mcp_tool_use and mcp_tool_result blocks.

Python:

```python
import os
import anthropic

client = anthropic.Anthropic()
response = client.beta.messages.create(
    model="claude-opus-5",
    max_tokens=16000,
    betas=["mcp-client-2025-11-20"],
    mcp_servers=[{
        "type": "url",
        "url": "https://mcp.bydomu.com/mcp",
        "name": "bydomu",
        "authorization_token": os.environ["BYDOMU_API_KEY"],
    }],
    tools=[{"type": "mcp_toolset", "mcp_server_name": "bydomu"}],
    messages=[{"role": "user", "content": "¿Qué citas tengo mañana?"}],
)
for block in response.content:
    if block.type == "text":
        print(block.text)
```

TypeScript:

```ts
import Anthropic from "@anthropic-ai/sdk";

const client = new Anthropic();
const response = await client.beta.messages.create({
  model: "claude-opus-5",
  max_tokens: 16000,
  betas: ["mcp-client-2025-11-20"],
  mcp_servers: [{
    type: "url",
    url: "https://mcp.bydomu.com/mcp",
    name: "bydomu",
    authorization_token: process.env.BYDOMU_API_KEY,
  }],
  tools: [{ type: "mcp_toolset", mcp_server_name: "bydomu" }],
  messages: [{ role: "user", content: "¿Qué negocios están en negociación?" }],
});
for (const block of response.content) {
  if (block.type === "text") console.log(block.text);
}
```

To keep only some tools, use default_config and configs inside the mcp_toolset. The connector works on the Claude API, not on Amazon Bedrock or Google Vertex AI.

## What to keep in mind

- The data ByDomu returns goes through the model provider: check their retention terms before sending customer data.
- Each model query counts toward the key’s limit (60 per minute); get_summary makes several reads at once.
- If you need to write (create a contact, move a deal), the MCP doesn’t: define your own tool that calls the REST API ( `https://api.bydomu.com/v1`) with a key approved for it and an Idempotency-Key.

## What it can do, how to revoke it and good practices

The server is read-only: the AI can query, but it doesn’t create, change or delete anything, and it never messages your customers. It only sees what these permissions allow, with a secret key’s limit (60 requests per minute).

It can Permission

Search and view published listings `portal:read`

Search and view contacts `contacts:read`

Calendar and appointments `appointments:read`

Read a contact’s messages `conversations:read`

Pipelines and deals `deals:read`

Pending tasks `tasks:read`

With a key, the AI sees whatever that key allows. To cut access, pause or delete the key in Settings › API Keys; the next call returns 401.

- One key per integration, with only the read permissions it uses. Leave conversations:read out if you don’t need messages.
- The key goes in an environment variable or the client’s secret store, never pasted into a chat, a repository file or a URL.
- What ByDomu returns includes text your customers wrote: treat it as data, not instructions. Don’t chain this connector with tools that send emails or messages without a person approving it.
- Review Connected apps now and then and remove what’s no longer used.