Technical guide to the Vamo API and MCP

This guide is for the people setting Vamo up for a team: administrators, platform and developer enablement. Vamo finds software engineers by the work they have done on GitHub. People reach it through their AI assistant, and developers call it from code.

The parts and their addresses

Part	Address	Used by
Vamo app	app.vamotalent.ai	People: sign in, connect an assistant, manage keys
MCP server	mcp.vamotalent.ai/mcp/search	AI assistants that support remote MCP servers
REST API	api.vamotalent.ai	Code, scripts and coding agents
API reference	docs.vamotalent.ai/developers	Developers. Readable endpoints, parameters and errors
OpenAPI spec	api.vamotalent.ai/openapi.json	Agents and tools. A machine-readable file for configuring an agent or generating a client. No key needed
Docs	docs.vamotalent.ai	This support center and the API reference
Skills	github.com/vamo-ai/vamo-skills	Instructions that teach an agent the API

The MCP server is a thin layer over the public API. It runs the same operations, with the same permissions and defaults. There is no SDK: developers read the API reference, and agents or code generators use the OpenAPI spec.

Addresses to allow

Allow these over HTTPS:

• app.vamotalent.ai: people signing in and approving tools.
• mcp.vamotalent.ai: AI assistants connected to the MCP server.
• api.vamotalent.ai: code, coding agents and skills.
• docs.vamotalent.ai: documentation.
• github.com: only if your teams install the skills plugin.

Skills in Claude also need Claude's sandbox allowed to reach api.vamotalent.ai. On a Claude Team or Enterprise workspace, only an owner can change that. MCP connections are not affected by that setting.

MCP or API

	MCP server	REST API
Called by	An AI assistant	Your code or a coding agent
Signs in with	OAuth in the browser, or an API key header	An API key
Developer search, filters, ranking	Yes	Yes
Lookup by GitHub login, similar people	Yes	Yes
Research reports, email addresses	Yes	Yes
Lists and contacts	Yes	Yes
Account usage and balance	No	Yes, with a platform key

Through MCP, the assistant reads Vamo's guide, then writes one small program that runs on Vamo's side. That program runs in a sandbox that can reach only Vamo's published operations. What code mode is explains it in plain terms. Every operation, parameter and error is in the API reference.

Sign-in, keys and the setup prompt

OAuth sign-in (MCP). The AI tool opens a Vamo page and the person approves it. This is OAuth 2.1 with PKCE, and tools register themselves on first connect. Sign-in is accepted from Claude, ChatGPT and Cursor, and from tools on the person's own computer. Access tokens last an hour and refresh while in use. After 90 days without use, the person signs in again.

API keys. Created at Set up > API keys, in two kinds. Search keys do the work: search, research, ranking, lists and contacts. Platform keys manage the account's search keys and read its usage and balance; only the account owner can create one. A key starts with vamo_sk_, is shown once, and Vamo stores only a hash of it. Send it as Authorization: Bearer <key>. To rotate, create a new key, move the tool to it, and revoke the old one. Use one key per tool or service, so each can be revoked alone.

Setup prompt. Copy setup prompt on the Home page copies one line with a single-use code that lasts ten minutes. Pasted into an agent, the code is traded for a key that the agent stores on that person's computer. The setup prompt and fix-it prompt shows the full text and when to use each.

The Vamo MCP server holds no credentials of its own. It forwards the caller's sign-in or key to the API with each request.

Controls

• Scope. A search key or signed-in tool can only search, research and rank developers, and manage lists and contacts. A platform key can only manage search keys and read usage. Neither can change team members.
• Who can connect. API keys and approving sign-ins are on the Pro and Enterprise plans and on Vamo trials. A read-only member can do neither.
• Traceable. Every connection belongs to one person's Vamo login. Owners and admins see every key and signed-in tool on the account, with when each was last used.
• Revoke. At Set up > API keys, Revoke… ends a key and Sign out… ends a signed-in tool. Either stops working at once.
• Usage. Per-key usage limits are on the roadmap. Today usage draws on what the account already has, and nothing tops up automatically. Adding ?vamo_estimate to a call previews it without running it. Over a rate limit, the API returns HTTP 429 with Retry-After.
• Support. Every API response has an x-request-id header. Quote it when you report a problem.

For data handling, retention and contract terms, ask your Vamo contact.

Rollout checklist

1. Allow the addresses above on your network and in your AI tool's settings.
2. Decide which AI tool people will use. A company-managed account keeps the connection under your own controls.
3. If they will sign in from Claude or ChatGPT, allow custom connectors in that workspace.
4. Confirm the people connecting are not read-only members in Vamo.
5. Have one person connect end to end with Getting started with the Vamo API and run a search.
6. Give developers the API reference and the skills plugin. Point agents at the OpenAPI spec.

If a connection fails later, How do I reconnect Vamo or sign in again? and Copy fix-it prompt on Home cover most cases.