Open WebUI

Open WebUI ships native Streamable HTTP MCP support. No mcpo proxy needed for remote servers. It also handles the full OAuth 2.1 + DCR handshake, matching how Engram authenticates Claude Desktop. Protocol background lives at MCP.

Prerequisites

Before you start, confirm:

• You have an Engram account at app.engram.page.
• At least one vault is synced. Open the Obsidian plugin or the web app and confirm notes have synced within the last day.
• You can sign in via browser. The MCP auth flow opens a browser window.
• If you plan to use an API key instead of OAuth: API keys need Pro. OAuth sign-in works on every tier, including Free, and is the recommended path. Free and Starter cannot create or use API keys.

Plus an Open WebUI-specific:

• Open WebUI v0.6.31 or newer (native HTTP MCP shipped in that release).
• WEBUI_SECRET_KEY is set to a long, stable random string in your Open WebUI environment. Without it, OAuth tokens can’t be decrypted after a restart, and connections drop on every reboot.

Endpoint

https://mcp.engram.page

Setup

1. Open the External Tools settings. As an admin, open Admin Settings → External Tools → + Add Server.

2. Configure the server. Fill the form:

Type: MCP (Streamable HTTP)
URL:  https://mcp.engram.page

For Auth, pick OAuth 2.1 for the browser-based handshake, or Bearer plus an Engram API key for the static-token path. Save. The server appears in the External Tools list.

3. Enable in a chat. Hit the + button → Integrations → Tools → enable Engram.

First-run auth

For the OAuth path, the first tool call triggers a browser redirect to Engram’s consent screen. After you approve, Open WebUI receives access and refresh tokens, encrypts them with WEBUI_SECRET_KEY, and reuses them.

For the Bearer path, paste your Engram API key (generate one at app.engram.page/settings/api-keys) when configuring the server. The header is sent on every request.

The grant is the full mcp scope. Granular per-action scopes are on the roadmap.

Tell the model to use it

The durable place to put a “reach for Engram” hint is the system prompt, either globally in Admin Settings → Models → edit model → System Prompt, or per-chat via Controls → System Prompt. Add this line:

Engram holds my personal notes. Treat it as your long-term memory of me. Search it when a question depends on context I might have shared before. Before saving or updating a note, ask first.

For workspace-wide rules, create a custom Model preset and bake the prompt into it.

Try it

In a chat with Engram enabled in the Tools menu, ask:

• Search my vault for notes about the engineering interview process and summarize the top three.
• Find anything I wrote about embeddings in the last month.

Open WebUI calls Engram’s search (or get_note, write_note, etc.) tool, pulls back results, and answers in-context. If the tool fires, you’re set.

Troubleshooting

• Error decrypting tokens after a restart. WEBUI_SECRET_KEY was unset, changed, or rotated. Set it to a stable value, then re-run OAuth consent for Engram.
• 401 with the Bearer path. The API-key field was left blank or the token was revoked. Either paste a fresh key or switch the server’s Auth setting back to OAuth 2.1.
• Tools don’t show in the chat picker. The server saved but isn’t enabled for this chat. + → Integrations → Tools → toggle Engram on.

For cross-client failures, see Troubleshooting.

Revocation

To disconnect Open WebUI from Engram:

1. In Open WebUI, find the connector or MCP server entry and remove it.
2. In Engram, open your account → API Keys & Sessions and revoke the matching session.
3. The OAuth token is invalidated server-side. Open WebUI will need to re-authenticate to reconnect.

To drop it client-side, remove the server from Admin Settings → External Tools.

Next steps

MCPProtocol overview.

ScopesWhat the grant covers.

All integrationsPick a different client.