Qistas legal research, inside Claude and ChatGPT

01Who can use it

A current Qistas subscription is required. The connector does not create accounts and cannot grant access on its own — users sign in with the Qistas credentials they already have, and their existing subscription determines what they can do.

If your organisation subscribes to Qistas, your administrator controls, per user:

• which countries' legal content they may search;
• whether they may use the research assistant at all;
• how many searches they may run in a given period.

All three are read from the subscription at the moment of each request. Nothing is granted by the connector itself.

02What it can do

The connector exposes one research tool and one diagnostic tool. That is the complete surface — it cannot do anything else.

Parameters of ask_qistas

An unrecognised country is rejected with an error, never answered from a different country's law.

What it returns

A written answer, plus the source articles it relied on — each with its article number and a link into Qistas. Where no relevant material is found, the connector says so rather than composing an answer.

03What it cannot do

This matters more than the feature list when you are assessing risk.

04How sign-in works

1. The user adds https://mcp.qistas.ai/mcp as a connector.
2. Their browser opens Qistas's own sign-in page, served from mcp.qistas.ai.
3. They enter their Qistas username and password there.
4. Qistas verifies the credentials and returns the client an access token.

Sign-in page security

• It loads no third-party scripts, fonts, trackers, or analytics. Its Content Security Policy is default-src 'none' with no script directive at all, so no JavaScript can execute on it — including ours.
• Served over TLS only, never cached, and cannot be embedded in a frame.
• Failed sign-ins return one identical message whatever the cause, so the page cannot be used to discover whether an account exists.
• Repeated failed attempts lock the account for five minutes.

Tokens and sessions

Because tokens live in memory, a server restart signs everyone out. Revoking a connector in the MCP client invalidates that session immediately and does not affect the user's other sessions.

05What data is sent, and where

Review this section before approving the connector for confidential matters.

Sent to Qistas on each search

Recorded in your Qistas administration system

The same activity log used by the Qistas web application, so your administrators can review usage. Each record holds who ran the search and when, the country searched, the text of the question, and the number of citations returned.

Not collected

No files, no documents, no message history from the MCP client, no contact data, and no content from other connectors. The connector never receives conversation context — only the single question passed to the tool.

Third parties

The question is processed by Qistas's own legal research service. It is not sold, and it is not shared with advertising or analytics providers.

06Administrator controls

Every request is checked against the user's live subscription — not a copy made at sign-in — so changes take effect promptly.

1. Assistant entitlement. If the subscription does not include the research assistant, the request is refused.
2. Country licensing. Users may only search countries their subscription covers. Asking about an unlicensed country returns a clear refusal naming the countries they do hold.
3. Usage limits. If the user has a search allowance, it is checked before the search runs, and the search is refused once the allowance is exhausted.
4. Account status. Suspended, expired, or deactivated accounts cannot sign in.

Administrators manage all of this in the Qistas administration system. No configuration is needed inside the MCP client.

07For IT administrators

Network. Outbound HTTPS to mcp.qistas.ai on port 443 is all that is required on the client side. No inbound access, no VPN, no agent, and nothing installed on user machines.

Rollout. The connector can be enabled organisation-wide; it grants nothing by itself, because access is still governed by each user's Qistas subscription. A user without a Qistas account cannot use it at all.

Revocation. Removing a user in the Qistas administration system stops new sign-ins. To end an existing session immediately, remove the connector in the MCP client or contact Qistas support.

Audit. Every search is recorded against a named user in your Qistas activity log, with timestamp, country and question text — the same audit trail as the Qistas web application.

08Getting connected

Claude — Settings → Connectors → Add custom connector → paste https://mcp.qistas.ai/mcp → Connect → sign in with your Qistas account.

ChatGPT — Settings → Connectors → add a custom connector with the same URL, then sign in with your Qistas account. Custom connectors are not available on every ChatGPT plan; check yours if the option does not appear.

Other MCP clients — add https://mcp.qistas.ai/mcp as a remote MCP server over streamable HTTP. Clients supporting OAuth 2.1 with dynamic client registration connect without further configuration.

Using it

Ask naturally, and say which country applies:

What notice period is required to terminate an employment contract in Jordan?

ما هي مدة الإشعار المطلوبة لإنهاء عقد العمل في الإمارات؟

09Troubleshooting

Signing in from a second client — Claude and ChatGPT, say — creates an independent session; it does not end the first. Both draw on the same subscription allowance.

10Contact