Evermont for Claude, ChatGPT and Codex

Evermont is a regulatory filing desk for insurance rate, rule and form filing teams. It connects to your AI assistant over the Model Context Protocol (MCP) and gives it tools for three kinds of work, with answers cited to the filing, document or source they came from:

• SERFF research. Search public filings from other carriers by state, company, product, line and date, open their documents and download the originals.
• State requirements. Work out what a state requires for a filing, row by row, with the statute, regulation or department guidance behind each requirement and the official forms that apply.
• Your own filings. Create filing records in your Evermont organization, upload and search documents, fill state forms, draft Word and Excel documents, run versioned actuarial calculations and track regulator objections.

Evermont prepares and drafts. It never submits a filing to a regulator, and its output is not legal or actuarial advice: requirements carry citations so a person can check them, and people at your company review, approve and submit.

The Evermont connector gives your assistant the tools. The Evermont plugin adds skills, written instructions that tell the assistant which tools to use and in what order, for filing workflow, requirements, objection responses, actuarial calculations, reviewer packets, drafting and QA, SERFF research, regulatory research and recurring routines.

• An Evermont organization account. Evermont is a paid service for businesses. Your organization’s owner signs up with an access code from Evermont (contact us for one), then invites teammates under Organization → Members. Already invited? Sign in.
• An AI client that supports remote MCP servers. Claude (web, desktop and mobile), Claude Code, Claude Cowork, ChatGPT and Codex all do. Some clients limit custom connections by plan or workspace role; each client’s section below says how.
• The right role for admin tasks. Any member can connect by signing in. Only organization owners and admins can create API keys and choose which tools the organization’s agents get.

Every client connects to the same server. Sign in with your Evermont account wherever your client supports it, which all of the clients below do. Use an API key only for a setup that cannot sign in.

https://api.evermont.ai/mcp

claude mcp add --transport http evermont https://api.evermont.ai/mcp

codex mcp add evermont --url https://api.evermont.ai/mcp
codex mcp login evermont

[mcp_servers.evermont]
url = "https://api.evermont.ai/mcp"
startup_timeout_sec = 20
tool_timeout_sec = 200

To check the connection, ask your assistant: “Call evermont_whoami and confirm my Evermont connection.” It answers with your organization, the user or key it connected as, and your credit usage.

How sign-in works

Evermont uses OAuth 2.1 with PKCE. The authorization server is https://evermont.ai. Clients find it from the server’s metadata and register themselves, so there is nothing to configure: you are sent to evermont.ai, you sign in, and you approve the connection.

What you approve

The consent screen names the client asking for access and where you will return, lists the access requested, and asks you to choose an organization if you belong to more than one. The connection can reach only the organization you choose. Clients ask for these scopes:

The scopes decide which tools a signed-in connection can see and call. filings:read covers the tools that read your organization’s filings and documents, filings:write the tools that create or change them, and serff:read SERFF research, filing guidance and the live regulatory search. A few tools that combine your filings with SERFF data need a filings scope and serff:read, and evermont_whoami needs none. Write access does not include read access. A client that does not name scopes is asked for all three. Calling a tool the connection was not granted returns a message naming the missing scope; connect again and approve that access to use it.

Scopes only narrow what the organization allows: a connection never gets a tool an owner or admin has switched off (see Turning tools on and off). Within its scopes a connection can use those tools whatever your role. API keys are not limited by scopes.

Sessions

Access tokens expire after one hour, and your client renews them with a refresh token. Refresh tokens are replaced each time they are used and expire after 30 days without use. If your organization membership ends, the connection stops renewing and you need to connect again. When an owner or admin removes you from the organization, or you delete your Evermont account, Evermont also stops accepting the access tokens already issued to you, normally within a minute.

Disconnecting

• Claude, Cowork and the Claude apps: Customize → Connectors, then disconnect Evermont.
• Claude Code: run /mcp, select evermont and choose Clear authentication.
• ChatGPT and Codex: remove Evermont from the client’s plugin or MCP server settings.

Disconnecting removes Evermont’s tokens from your client, and your client may also ask Evermont to revoke them. To make sure a connection is ended on Evermont’s side, email hi@evermont.ai from your account’s email address and we will revoke it. An access token already issued keeps working until it expires, at most one hour later. API keys are revoked separately, in Integrations (see API keys).

Use an API key for a setup that cannot sign in, such as the downloaded Cowork plugin or an automated job. A key acts for the whole organization rather than for a person, so prefer signing in wherever you can.

Create a key

Organization owners and admins create keys in the Evermont web app under Integrations → Create API key. Keys start with evk_ and are shown in full only once, so store yours like a password. An organization can have up to 10 active keys. Give each person or job its own key, because the rate limit applies per key.

Send the key

Send the key with every request in either header. Use x-api-key when a client keeps the Authorization header for itself:

Authorization: Bearer evk_...
x-api-key: evk_...

Claude Code and Codex read the key from the EVERMONT_API_KEY environment variable when they start. Set it first:

export EVERMONT_API_KEY="evk_..."
# To keep it, add the line above to ~/.zshrc or ~/.bashrc

# This PowerShell window
$env:EVERMONT_API_KEY="evk_..."
# Every window and app you start from now on
setx EVERMONT_API_KEY "evk_..."

Then open a new terminal, or quit VS Code completely and reopen it, so Claude Code sees the variable. If it is not set, Claude Code sends the text ${EVERMONT_API_KEY} instead of your key and the connection fails with a 401 error. If you would rather not manage a key, sign in instead (see Claude Code).

In Claude Code, add the server with the variable, not the key. The single quotes stop your shell from expanding it; Claude Code reads it when it connects, and --scope user keeps it out of any project file:

claude mcp add --transport http evermont https://api.evermont.ai/mcp --header 'Authorization: Bearer ${EVERMONT_API_KEY}' --scope user

In Codex, name the environment variable in the server block instead of logging in:

[mcp_servers.evermont]
url = "https://api.evermont.ai/mcp"
bearer_token_env_var = "EVERMONT_API_KEY"
startup_timeout_sec = 20
tool_timeout_sec = 200

In a Claude custom connector, choose No sign in and add a request header named x-api-key with the key as its value. Everyone who uses that connector then acts with the key’s access.

Revoke a key

Revoke a key in Integrations when it is no longer needed or may have leaked. It stops working everywhere within about a minute. Revoking a key does not affect connections made by signing in.

A connection sees 29 tools by default: 18 read-only tools that look things up, 4 that add new records and 7 that can change records that already exist. Each tool publishes MCP hints your client uses to decide when to ask you first:

• visibilityRead-only readOnlyHint: true. Changes nothing.
• addAdds records destructiveHint: false. Creates something new, such as a filing, a document or a reference copy, and never overwrites.
• editChanges records destructiveHint: true. Can update an existing filing, requirement row or objection.

Write tools act only inside the organization you connected. Changes to a filing’s details, documents, objections and requirement rows are recorded in its activity history with the user or key that made them; saved intake answers and requirements builds record the user or key on the record itself but are not listed there. No tool deletes filings or documents, submits anything to a regulator or changes SERFF; people delete filings and documents in the web app (see Deleting data). The SERFF tools that can fetch a missing filing from SERFF Filing Access reach outside Evermont, so they also carry openWorldHint: true.

The first three prompts use public data every organization can reach. The rest work on a filing in your own organization and create records there.

• The SERFF corpus holds public filings from 49 states and the District of Columbia, from 2011 to the present, indexed by their filing details. Filings before 2011 are not held.
• Florida is not included. Florida files through its own IRFS system rather than SERFF, so Evermont cannot fetch Florida filings live either.
• Searches run one state at a time. For a countrywide question, your assistant searches each state in turn.
• Searches match each filing’s details: company, product, tracking number, type, line and status. Your assistant can open any filing’s documents by name and read them.
• If you give a SERFF tracking number or filing ID with its state and Evermont’s index does not have it, Evermont can fetch that filing live from SERFF Filing Access. The first answer may say the fetch is in progress; asking again shortly returns the filing.
• State filing guidance cites its sources. For anything newer, your assistant can search the live web.
• Empty results do not prove that no filing, rule or precedent exists. Check original documents and current official sources before relying on a claim.

Where data lives

• Evermont’s application, databases and file storage run in Google Cloud’s United States regions.
• Data is encrypted in transit with TLS and encrypted at rest by Google Cloud.

Access

• Every request is checked against the organization it belongs to. A connection reaches only the organization you approved, plus public regulatory data.
• Apart from connection details (your sign-in token or API key, your IP address and client software information), Evermont receives only the arguments your assistant puts in each tool call. It does not receive your conversation history, your assistant’s memory or the files in your chats, and it ignores extra client details such as locale or location.
• API keys, OAuth refresh tokens and authorization codes are stored only as one-way hashes. Access tokens expire after one hour and are not stored.
• Download links that tools return are signed and expire after ten minutes. Anyone who has a link can use it until then, so treat it like the file.
• Each tool call is logged with the tool, time, organization, the key or signed-in user that made it, the outcome and, for signed-in connections, the client app. Request logs are kept for about thirty days. Usage records, which count calls toward your credits, are kept for seven years.
• Changes an agent makes to a filing’s details, documents, objections and requirement rows are recorded in that filing’s activity history, so your team can review what the assistant did.

AI processing

• Evermont does not currently use your organization’s data to train AI models.
• When a document is uploaded or copied from SERFF with indexing on (the default), Evermont extracts the text of PDFs with Google Document AI and reads other file types itself, then sends the text through OpenRouter to AI models that classify tables, add a line of context to each passage, write short summaries and create embeddings for search. Documents uploaded in the web app are also classified by a model. Searching your documents, including gathering evidence for an objection, sends the search text for embedding the same way.
• Looking up filings, SERFF records and requirements, and running calculations, does not send your data to a language model.
• Prompts, files and tool results in your conversations are also handled by your AI client’s provider under its own terms.

Text from documents and the web

Tool results that carry text Evermont did not write, such as your uploaded documents, other carriers’ SERFF filings, state sources and objection letters, are marked as untrusted content, with a notice telling your assistant to treat that text as data, not instructions. A document or web page can still contain text aimed at your assistant. Your assistant should not follow instructions it finds there, so review what it proposes before you approve changes.

Deleting data

No Evermont tool deletes filings or documents. People delete them in the Evermont web app:

• The person who uploaded a document, or an owner or admin, can delete it. Evermont deletes the file and what it derived from it, including its extracted text, search index entries and the filing summaries that drew on it. Documents made from it, such as a filled form, stay until they are deleted too.
• Owners and admins can delete a filing after typing its name; the confirmation shows how many documents, objections and other records go with it. The filing, its documents, objections and activity history are then deleted in the background.
• Members can delete their own account under Settings; an organization’s owner cannot. The account’s API keys and signed-in connections stop working, and the organization keeps the work the member created.
• To delete a whole organization, an owner or admin emails hi@evermont.ai.

Deleted data can remain in backups until they expire, usually after about a week and never more than thirty days. The Privacy Policy’s retention and deletion section lists what each deletion removes and what is kept.

Reporting a security issue

Email hi@evermont.ai with what you found and how to reproduce it. Do not access data that is not yours, disrupt the service, or run load or penetration tests without our written permission. Our security contact is also published in security.txt.

The Privacy Policy lists every subprocessor and every part of the service that sends content to an AI provider, and covers retention and deletion; the Terms of Service cover use of the service, including the data you must not upload.

• 120 requests a minute per API key, or per user for connections made by signing in. Each tool call is one request; your client also sends a few requests when it connects.
• A network address that keeps sending invalid keys or tokens is refused for a short time.
• Over a limit, Evermont answers HTTP 429 with JSON-RPC error -32002 and a Retry-After header giving the seconds to wait.
• A single tool result is capped at about 24,000 characters. Longer results come back in pages, with a cursor your assistant uses to ask for the next one.
• Tool calls count toward your organization’s monthly Evermont credits. Owners and admins see usage under Organization in the web app.

Codex says the evermont MCP server is not logged in

Adding the server does not sign you in. Run codex mcp login evermont, or select Authenticate next to evermont under gear menu → MCP servers in the IDE extension or Settings → MCP servers in the ChatGPT desktop app, then sign in with your Evermont account.

Your client keeps asking you to sign in, or says the token was rejected

Connect again. Sessions end after 30 days without use, and when your organization membership ends. In Claude, open Customize → Connectors and connect Evermont again. In Claude Code, run /mcp and authenticate evermont. In Codex, run codex mcp login evermont, or select Authenticate next to evermont under MCP servers. In ChatGPT, reconnect Evermont from Plugins.

“You need an active organization membership”

The consent screen shows this when your account does not belong to an Evermont organization yet. Ask your organization’s owner or an admin to invite you, accept the invitation, then connect again.

You see another organization’s filings

Each connection is tied to the organization chosen on the consent screen. Ask your assistant to run evermont_whoami to see which one it is using. To switch, disconnect Evermont in your client, connect again and choose the right organization.

401 “Missing or invalid API key”

The key was mistyped, revoked or not sent. Check that it is sent as Authorization: Bearer evk_… or x-api-key: evk_…, and that EVERMONT_API_KEY is set in the shell that starts your client. A revoked key can take up to a minute to stop working. If you connected by signing in, connect again instead.

401 “unexpanded environment variable placeholder”

Your client sent the text ${EVERMONT_API_KEY} instead of your key, because the variable was not set when the client started. Set it as shown under API keys (setx on Windows), then open a new terminal or quit VS Code completely and reopen it.

429 “Rate limit exceeded”

Wait for the number of seconds in the response, then try again. If several people share one API key, give each person their own key or have them sign in. If the message is about too many requests or failed attempts from your client, check that your key or sign-in is valid before retrying.

A tool is missing, or says it is switched off

An owner or admin may have switched it off under Integrations → Tools; the tool’s message says who can turn it back on. Tools that run Evermont’s own AI models need Evermont to make them available first. After a change, reconnect so your client loads the new tool list. If a tool says it is disabled by Evermont, contact us.

The assistant says SERFF was not checked live

When a SERFF lookup finds nothing in Evermont’s index, the answer says what happened with SERFF Filing Access itself. not_attempted means Evermont did not ask SERFF, and the message says why: for example the identifier is not in SERFF’s format, the search covers more than one state, it uses filters a live SERFF listing cannot apply, or the company name looks like a misspelling of one Evermont already holds. The answer also carries check_inputs, what to double-check (state, line, company spelling, identifier, dates), and try_instead, searches to run next. If a spelling Evermont corrected was right after all, ask your assistant to check SERFF live with that spelling.

Other answers: in_progress means the fetch is running, so ask again in about 30 seconds; scheduled means live lookups are paused for a while and the answer says when to try again; not_found means SERFF has no such filing in that state. Florida filings are never in SERFF.

“Not enough credits”

Credits are tracked, not capped: going over your organization’s monthly allowance does not block anything. Where Evermont enforces the allowance, only tools that run on Evermont’s own models check your credits first and are refused when not enough remain; every other tool keeps working. Credits reset on the 1st of each month (UTC). Owners and admins see usage under Organization → Billing in the web app. Anyone can ask their assistant to run evermont_whoami, which reports the credits used and remaining and whether the allowance is enforced. For more credits, email hi@evermont.ai.

A document you uploaded does not show up in search

Search matches the words in a document’s text, which Evermont reads the first time the document is searched or opened. If a search says some documents are still being read, search again. Check that the words you searched for appear in the document. A scanned PDF has no text layer, so it cannot be searched; ask your assistant to open it instead.

Email hi@evermont.ai or use our contact page. Include your organization, the client you use, the tool name and error text, and roughly when it happened with your time zone. If you use an API key, send only its first few characters, as shown in Integrations. Never send us a full key or token.

October 24, 2026

Six tools folded into the tools that already did the same job: serff_filing_get with download set to true gives the per-document links serff_filing_download gave, document_create with pdf_of_document_id saves the PDF copy document_export_pdf saved, requirements_prepare with answers saves the intake answers requirements_answer saved, and filing_activity_list with view set to changes gives the feed filing_events_list gave, without the retired document_ingestion_completed event. serff_filing_get and filing_documents_list with zip set to true give the ZIP links serff_filing_zip and filing_documents_zip gave. An organization owner can switch the old names back on until December 1, 2026. regulatory_search, a live web search, is no longer offered: your assistant’s own web search covers anything newer than Evermont’s state research.

October 22, 2026

Codex setup says how to sign in after adding the server: with the CLI, or with Authenticate in the IDE extension or the ChatGPT desktop app. It also names the timeout lines to add when you add the server with codex mcp add or the Add server form. serff_document_download and serff_filing_download preview documents by default and return download links only when you ask to download.

October 20, 2026

OAuth scopes now decide which tools a signed-in connection can use. Results that carry text from documents, filings or web pages are marked as untrusted content. New section on deleting documents, filings, accounts and organizations; removed members lose access, normally within a minute.

October 19, 2026

Documentation revised. Setup steps checked against current Claude, ChatGPT and Codex documentation, with the full tool reference, data handling, rate limits and troubleshooting.

October 17, 2026

SERFF lookups say when SERFF Filing Access was not checked live, what to double-check and what to search instead. Every tool publishes accurate read-only, destructive and open-world hints.