Bring your own agent
to the case file.

Daubert exposes one Model Context Protocol endpoint over Streamable HTTP: a single POST /mcp. It is stateless. There is no session id to hold, no socket to keep open, and no server side conversation to resume. Each request authenticates, builds the tool surface for that session, answers, and tears down.

The intelligence is your agent. Daubert runs no model of its own on this path. It holds the case file, the graph, the chain access, and the roles. Your agent decides what to call, and Daubert decides whether it may.

Any client that speaks remote MCP over HTTP can connect: the Claude apps, Claude Code, and ChatGPT in developer mode. Nothing in the tool surface is client specific.

A connected agent is a session, not an account. It sees what you can see and changes what you can change. Connecting one does not widen the door.

Paste one address, sign in, choose the organization. Dynamic client registration is supported, so there is no client id to generate and no secret to store, and nothing runs locally.

One thing to check first: you need a Daubert account holding admin or member on at least one organization. A guest cannot connect an agent. The same address is shown inside Daubert under Account · Connected Agents.

Claude

1. 1Open Settings · Customize · Connectors.
2. 2Scroll past the partner directory and click +, then Add custom connector.
3. 3Name it "Daubert" and paste the address above.
4. 4Leave Advanced settings empty. No client id is needed.
5. 5Click Add. A browser tab opens where you sign in, choose the organization, and approve access.

One connector covers every Claude surface. Claude Desktop, claude.ai, Cowork, and Claude Code all read the same catalog once it is added to your account.

On a Team or Enterprise plan, your workspace admin registers Daubert once under Organization settings · Connectors. Everyone else then sees a Connect button on that entry.

ChatGPT

1. 1Turn on developer mode first, under Settings · Plugins · Advanced. Custom MCP connectors do not appear until it is on. This is the step people miss.
2. 2Click Create, name it "Daubert", and paste the address above. Keep the /mcp path on the end.
3. 3Sign in when the browser opens, choose the organization, and approve access.

Two differences worth knowing. ChatGPT has no installable skill files, so ask your agent to call get_skill for the procedure it needs, or paste the daubert-overview text into Settings · Personalization · Custom instructions once. And without a way to pre-approve tools it may ask before each call. Approve once and it settles down.

What you are approving

The consent screen names the client asking for access, shows the address it will be redirected back to, and asks which organization the session is for. That choice is the whole scope of the session, and it cannot be changed afterwards. Connect a second agent, or a second organization, and you get a second session.

• Only admins and members can grant a session. A guest is refused at consent.
• The organization list is built from your own memberships on the server. A client cannot supply one.
• PKCE with S256 is the only accepted method. Clients are public, so no secret is ever issued.
• Codes, tokens, and sessions have the lifetimes in Limits and lifetimes.

On the first call after connecting, the session label is enriched with the client's own name and version and the operating system it reported, so Claude Desktop becomes something like Claude Desktop 1.4.2 · macOS in your account. That is cosmetic. It is how you tell two sessions apart when you go to revoke one.

Every request to POST /mcp runs the same chain of checks before a tool handler sees it. Nothing here is cached for the life of the token, and nothing is decided once at connection time.

• The organization is fixed at consent. A case id belonging to a different organization is refused, whatever the prompt says. This is checked before any case data is read, so it is not possible to confirm a case exists elsewhere by watching how the error changes.
• Membership is re-read on every call. Remove someone from the organization, or downgrade them to guest, and their agent stops on the next request, mid session. It does not wait for the token to expire.
• The role is checked per call, not per connection. Losing editor on a case takes writes away immediately while reads keep working.
• The principal is fixed in the handler. A tool cannot substitute a different user, organization, or session for itself.

The refusals, in the words they use

The first four are HTTP level and end the request. The last four come back inside the tool result as errors, so the conversation continues and the agent can correct itself.

There are two role systems, and MCP uses both. Your organization role decides whether you can connect an agent at all. Your case role decides what that agent can do on a given matter.

Case roles are ranked viewer below editor below owner. A tool gated at viewer accepts all three. A tool gated at editor accepts editor and owner. An explicit case membership always wins over the implicit one, so a case can grant access more narrowly than the organization does.

The four gates on the tool catalog

Guests are refused at consent rather than at the tool. There is no version of this where a guest connects an agent and finds out later that nothing works.

These are the same words the app uses. When your agent reports what it did, this is what it means.

organization

The tenant. Every case, production, and connected session belongs to exactly one.

case

The matter. It carries members, investigations, productions, and a data room.

investigation

One line of inquiry inside a case. A case can run several.

trace

The graph itself, stored under an investigation. An investigation can hold more than one.

node / edge

An address on the graph, and a transfer between two of them. Tools hand edges to the agent denormalized, carrying the from and to addresses rather than internal ids.

group / bundle

Collapsed sets of nodes and of edges. They travel with the graph on reads.

production

Work product on the record: a report, a chart, a chronology, a declaration, or a redline.

declaration

A production in one of five jurisdiction formats. The server renders the oath, the caption chrome, and the numbering. The agent supplies the content.

redline

A review of a draft someone else wrote. Creating one snapshots the draft's text into an immutable baseline, so the edits stay anchored to what was actually reviewed.

data room

The case's documents. Agents read them by id, and get extracted text back rather than raw bytes.

declarant

A saved expert witness profile: title, firm, qualifications, prior testimony, CV exhibit, rate, and disclosures.

declaration library

Reusable boilerplate blocks held across the organization, such as chain primers and authentication language.

labeled entity

A known address in the shared catalog: an exchange, a contract, a mixer, a service wallet.

session

One connected agent, bound to one user and one organization, revocable on its own.

agent action

One audit row. A write a session performed, with its target and its outcome.

skill

A workflow document. Seven are registered as prompts on connect, and any of them can be pulled mid task with get_skill.

Nineteen tools in four groups. You never call these yourself. Your agent does, in the course of working the matter, and the names are here so that when it tells you what it did, the sentence means something.

Tool names alone do not teach an agent how a declaration is structured or what a valid redline anchor looks like. Daubert registers seven workflow documents as MCP prompts, so the method arrives with the connection rather than having to be pasted into a system prompt.

get_skill reads more than the seven registered prompts. Three further documents are available by name and are worth pulling when the work calls for them: bitcoin-apis for Esplora UTXO queries, solana-apis for the Helius parsed transaction API, and product-knowledge for answering questions about Daubert itself.

A missing skill file is skipped rather than fatal. A session with a document unavailable still connects, minus that prompt.

Tool results come back as JSON text. Most are capped at 8192 bytes. Past that the payload is cut and a suffix is appended saying how many bytes were dropped, so the agent is told explicitly that it is looking at part of something rather than treating a fragment as the whole.

What is exempt from the cap

• get_investigation returns the full graph. A slimmed trace routinely exceeds 8 KB and cutting it would produce a graph missing edges without saying so.
• list_data_room_files returns the manifest up to 500 entries, with a truncated flag of its own.
• read_data_room_file returns the document. Text extraction is the point of the call.

blockchain_fetch_history handles the cap differently again. Rather than slicing raw bytes and handing back broken JSON, it trims the transaction array to the number of rows that fit and sets truncated: true with totalCount, so the agent knows how much history exists beyond what it received. Bitcoin input and output arrays are collapsed to counts first, so one large consolidation cannot consume the entire budget.

Errors do not end the conversation

A refused or failed tool call comes back as a normal result marked isError, carrying the message. It does not throw through the transport and it does not close the session. The agent reads the message, corrects itself, and carries on. That is why an agent that asks for a case in the wrong organization can recover in the same turn instead of dropping the connection.

Token lifetimes are the deployment defaults and can be tightened per environment. The rate limits are enforced per server instance.

Chain access runs on Daubert's server side API keys. There is nothing for you to provision and no key to rotate.

A legacy Bitcoin address starting 1 or 3 is also a valid base58 string, which makes it shape-ambiguous with Solana. Daubert resolves that in Bitcoin's favor, and the tool descriptions say so, so an agent picking a chain from an address alone does not silently query the wrong network.

Bitcoin transfers carry their UTXO provenance: inputs, outputs, fee, change evidence, and confirmation state. Solana transfers carry a transfer index, fee payer, and mint detail. Both survive import_transactions intact, and both are validated strictly on the way in, because a dropped field there is a wrong exhibit rather than a cosmetic loss.

The case file records what the agent did the same way it records what you did.

• Every write is audited. The session, the user, the organization, the action, the target, and the outcome. Successes and refusals both.
• Failures are audited too. A write the role gate refused leaves a row saying so. An agent cannot probe for access quietly.
• Reads are not audited. They are bounded by role, not by paperwork.
• Audit rows outlive sessions. Revoke a session and its history stays, still labeled with the agent that did the work.

Under Account · Connected Agents you see every session you have granted, with its label, when it was created, and when it was last used, alongside the most recent agent actions. Revoking one is immediate and affects only that session. Your other agents keep working.

Revocation is not the only kill switch. Removing someone from the organization stops all of their agents on the next call, without anyone having to find the sessions first.

The sign-in loop repeats

The client did not keep the token. Remove the connector and add it again. Registration is dynamic, so re-adding costs nothing and issues a fresh session.

Everything stopped mid conversation

Usually membership_revoked. Your organization membership was removed or downgraded to guest. That check runs per call, so it takes effect immediately rather than when the token expires.

The agent says a case does not exist

The id is not in this session's organization. Have it call list_cases and work from those ids. A session is bound to one organization and cannot reach another.

Writes fail but reads work

You hold viewer on that case. Reads are gated at viewer and writes at editor.

Results arrive incomplete

The 8 KB cap. Narrow the call: pass an address or token filter to get_investigation, a date range to blockchain_fetch_history, or read one production instead of listing them all.

Calls start failing in bursts

A rate limit. Sixty calls a minute per session, twenty a minute per address before authentication. Both windows slide, so they clear on their own.

The agent invents a workflow

It has not read the procedure. Ask it to pull the relevant skill first, or invoke the matching prompt. declarations and redlining in particular carry rules that cannot be guessed from tool names.

Still stuck? Request access or get in touch and a person will read it. Tell us what the agent was doing and what came back instead.