Outsource in Claude, ChatGPT, and Copilot

Model Context Protocol (MCP) is an open standard by Anthropic that lets any AI assistant securely call external tools on behalf of a user. Outsource ships a compliant MCP server, so once you connect it, Claude / ChatGPT / Copilot can answer questions like:

• "What did we post about the Africa Cup last quarter?"
• "What's on our content calendar next week?"
• "Any market signals for our brand worth acting on?"
• "List all my in-progress content requests."
• "Order a graphic design for Friday with this brief and the logo from our Drive."

The assistant sees only the workspace you connected it to. Besides reading, it can order a request and attach files — exactly as the portal’s New request form does, using your plan’s allowance — but it cannot publish, approve, cancel or delete anything. A member with the viewer role can only read.

Outsource exposes 8 tools. Every call is scoped to the one workspace membership the token or connection was issued for.

• list_requests

  List content requests (briefs, drafts, published posts) for the caller's client. Filter by status when known. Returns compact rows suitable for a chat summary — each row includes title, status, service (Instagram, LinkedIn, …), created date, due date, and whether a draft has been delivered.

• search_content

  Full-text search over the caller's content — brief titles, brief text, and the latest delivered draft. Use to answer questions like 'what did we post about X last quarter' or 'find our best-performing Y post'. Returns up to `limit` matches ordered by recency.

• get_calendar

  Get the caller's upcoming and recent content calendar — both requests with due dates and planned posts. Defaults to the next 14 days; pass explicit dates to widen. Use to answer 'what's on our calendar this week' or 'what's launching next Thursday'. Returns items ordered by date.

• get_brand_intel

  Recent market intelligence signals surfaced to this client — news, competitor mentions, industry moves. Only signals that passed the internal relevance threshold and were approved for client visibility are returned. Use to answer 'what's happening in our space' or 'anything worth posting about'.

• list_services

  List what the caller's Outsource workspace can order — the same services as the portal's New request screen — with how many of each are left this billing period, when the allowance resets, the earliest delivery date, and the fields each request form asks for (with the allowed values). Call this before create_request to pick the right service slug and to know which fields are required.

• create_request

  Create a content request in the caller's Outsource workspace — exactly as if they had filled the portal's New request form: it uses one unit of the plan's allowance for that service, the Outsource team is notified, and it appears in the portal. Call list_services first for the service slug, its required fields and the earliest due date. Confirm the service, the brief, the due date and any files with the user before calling. Files the user gives you: (1) If the file is on disk where you can run code — Claude Code, or claude.ai with code execution, where files uploaded in the chat are in /mnt/user-data/uploads/ — call get_upload_url, run the curl command it returns with that file, and put the returned path in uploaded_files. (2) If the file is reachable by a public link — Google Drive or Dropbox shared as 'anyone with the link', or a direct file URL — put the link in attachment_links. (3) Otherwise create the request, give the user the returned link and tell them the file is not attached yet: they drop it into the request themselves. A file is attached only if it is listed in the response's attachments.

• add_attachments

  Add files to an existing request of the caller's workspace. They are posted in the request's thread — exactly as if the user had dropped them there in the portal — so the Outsource team sees them and is notified. Use list_requests to find the request. Same file rules as create_request: a file on disk where you can run code goes through get_upload_url, then its path in uploaded_files (claude.ai code execution keeps files uploaded in the chat in /mnt/user-data/uploads/); a public link goes in attachment_links.

• get_upload_url

  Upload ONE file that is on disk where you can run code — the user's computer in Claude Code, or your sandbox in claude.ai with code execution, where files the user uploads in the chat are in /mnt/user-data/uploads/. Returns a one-time signed address: run the returned curl command with the file's real path, then pass the returned path in uploaded_files of create_request or add_attachments. Valid two hours; files up to 50 MB; images, PDF, Word/Excel/PowerPoint, MP4/MOV. If the upload fails with a network, proxy or DNS error, your sandbox cannot reach network_host: tell the user, who can allow that domain for code execution in Claude's settings, or drop the file into the request from its link.

Two flows, both live today.

• The assistant reads, orders requests and attaches files. It cannot publish, approve, cancel or delete anything. A request it orders uses the plan's allowance, like one made in the portal.
• A member with the viewer role can only read: ordering and attaching are refused.
• Scoped to the one workspace membership the token or connection was issued for; every query filters on that workspace.
• Files sent by link are fetched by our server only from public addresses, re-checked at every redirect, and must be an image, PDF, Office document or MP4/MOV of 50 MB at most — the same files the portal form accepts.
• Bearer tokens and OAuth access tokens are stored as sha256 hashes — a database leak cannot be replayed.
• PKCE (S256) required on the OAuth flow. No confidential-client secrets are issued to public MCP clients (Claude Desktop, ChatGPT).
• You can revoke any token or OAuth grant from Profile → Settings → AI Assistants at any time.
• Each token records when it was last used.
• Outsource data is hosted in the EU (Supabase Frankfurt, GDPR baseline). Sub-processors are documented at /sub-processors.

The MCP server implements the standard endpoints per the current spec:

Transport is Streamable HTTP per the current MCP spec, with JSON responses and no server-to-client stream.

• More write tools (generate_draft, schedule_publish) — behind the same consent gate.
• Multi-workspace switcher for members of >1 workspace.
• Anthropic MCP Directory + ChatGPT connector-store listings for one-click discovery.
• Copilot for M365 store listing for enterprise deployments.

Questions, integration issues, or want us to add a tool your team needs? Email contact@thegoodpicture.com and a founder will respond within one business day.

Data handling is governed by our Privacy Policy and Terms of Service. Sub-processors are listed at /sub-processors.