Open WebUI
Open WebUI ships native Streamable HTTP MCP support. No mcpo
proxy needed for remote servers. It also handles the full OAuth 2.1 +
DCR handshake, matching how Engram authenticates Claude Desktop.
Protocol background lives at MCP.
Prerequisites
Section titled “Prerequisites”Before you start, confirm:
- You have an Engram account at app.engram.page.
- At least one vault is synced. Open the Obsidian plugin or the web app and confirm notes have synced within the last day.
- You can sign in via browser. The MCP auth flow opens a browser window.
Plus an Open WebUI-specific:
- Open WebUI v0.6.31 or newer (native HTTP MCP shipped in that release).
WEBUI_SECRET_KEYis set to a long, stable random string in your Open WebUI environment. Without it, OAuth tokens can’t be decrypted after a restart, and connections drop on every reboot.
Endpoint
Section titled “Endpoint”https://mcp.engram.page/api/mcp1. Open the External Tools settings. As an admin, open Admin Settings → External Tools → + Add Server.
2. Configure the server. Fill the form:
Type: MCP (Streamable HTTP)URL: https://mcp.engram.page/api/mcpFor Auth, pick OAuth 2.1 for the browser-based handshake, or Bearer plus an Engram API key for the static-token path. Save. The server appears in the External Tools list.
3. Enable in a chat. Hit the + button → Integrations →
Tools → enable Engram.
First-run auth
Section titled “First-run auth”For the OAuth path, the first tool call triggers a browser redirect
to Engram’s consent screen. After you approve, Open WebUI receives
access and refresh tokens, encrypts them with WEBUI_SECRET_KEY, and
reuses them.
For the Bearer path, paste your Engram API key (generate one at
app.engram.page/settings/api-keys)
when configuring the server. The header is sent on every request.
The grant is the full mcp scope. Granular
per-action scopes are on the roadmap.
Tell the model to use it
Section titled “Tell the model to use it”The durable place to put a “reach for Engram” hint is the system prompt, either globally in Admin Settings → Models → edit model → System Prompt, or per-chat via Controls → System Prompt. Add this line:
Engram holds my personal notes. Treat it as your long-term memory of me. Search it when a question depends on context I might have shared before. Before saving or updating a note, ask first.
For workspace-wide rules, create a custom Model preset and bake the prompt into it.
Try it
Section titled “Try it”In a chat with Engram enabled in the Tools menu, ask:
- Search my vault for notes about the engineering interview process and summarize the top three.
- Find anything I wrote about embeddings in the last month.
Open WebUI calls Engram’s search (or get_note, write_note,
etc.) tool, pulls back results, and answers in-context. If the tool
fires, you’re set.
Troubleshooting
Section titled “Troubleshooting”Error decrypting tokensafter a restart.WEBUI_SECRET_KEYwas unset, changed, or rotated. Set it to a stable value, then re-run OAuth consent for Engram.- 401 with the Bearer path. The API-key field was left blank or the token was revoked. Either paste a fresh key or switch the server’s Auth setting back to OAuth 2.1.
- Tools don’t show in the chat picker. The server saved but
isn’t enabled for this chat.
+→ Integrations → Tools → toggle Engram on.
For cross-client failures, see Troubleshooting.
Revocation
Section titled “Revocation”To disconnect Open WebUI from Engram:
- In Open WebUI, find the connector or MCP server entry and remove it.
- In Engram, open your account → API Keys & Sessions and revoke the matching session.
- The OAuth token is invalidated server-side. Open WebUI will need to re-authenticate to reconnect.
To drop it client-side, remove the server from Admin Settings → External Tools.