Publishing an app on Tor and connecting your assistant to Impreza over Tor are separate tasks. This guide covers the second: the transport used by your MCP client to reach Impreza. Your assistant still uses the permissions you grant, and its AI provider can still receive prompts and tool results.
Impreza onion addresses
Use these addresses in Tor Browser or a client configured to use Tor. Keep each scheme and path exactly as shown; the portal uses HTTPS, while the API, hosted MCP and documentation addresses below use HTTP over Tor.
Customer portal
https://portal.imprezareshna326gqgmbdzwmnad2wnjmeowh45bs2buxarh5qummjad.onion/clientarea.phpSign in and manage your account in Tor Browser.
REST API base URL
http://api.imprezareshna326gqgmbdzwmnad2wnjmeowh45bs2buxarh5qummjad.onionSet this base URL in a compatible API client.
Hosted MCP endpoint
http://mcp.imprezareshna326gqgmbdzwmnad2wnjmeowh45bs2buxarh5qummjad.onion/mcpAdd this endpoint to a Tor-capable remote MCP client.
Documentation
http://docs.imprezareshna326gqgmbdzwmnad2wnjmeowh45bs2buxarh5qummjad.onion/Read setup and reference material in Tor Browser.
The API and MCP addresses are client configuration values, not ordinary sign-in pages. These are Impreza’s service addresses, not the address generated for your deployed app. Copy the current app address from its deployment details.
Choose the client connection
Hosted MCP with OAuth works only when the client explicitly supports the onion endpoint and a Tor proxy. Opening an authorization page in Tor Browser does not automatically route the client’s token exchange or later MCP requests through Tor.
Local MCP provides another path for compatible coding tools, including local-folder workflows. Use the REST API base URL listed above with the current Tor transport instructions. Do not substitute an arbitrary onion URL or assume every remote MCP client supports this setup.
Configure local transport explicitly
For local MCP connected to an onion API URL, set IMPREZA_PROXY to an explicit socks5://host:port proxy. Tor commonly listens on 9050; Tor Browser commonly uses 9150. Confirm the actual listener on your machine rather than choosing a port blindly.
When the proxy is unavailable, the client fails instead of falling back to direct DNS or clearnet. Do not remove the proxy setting to work around an onion connection error. Check the Tor process, endpoint and client configuration first. See the connection reference for current package configuration; no account secrets belong in a shared example.
Keep OAuth issuer and resource distinct
For hosted MCP, discover OAuth metadata through the same onion endpoint you will use. Its authorization server and consent redirect must identify that onion issuer.
The logical OAuth resource remains https://mcp.imprezahost.com/mcp, even though transport uses Tor. Do not rewrite that value to the onion address. Keep issuer, resource, state and PKCE validation enabled. A mismatch should be investigated rather than accepted by disabling checks.
Review consent and complete the return
Check the app name, redirect target and permission checkboxes. Read and Deploy are selected by default; Manage is not. For read-only access, uncheck Deploy even when the incoming authorization link requested only read.
A desktop client may receive the browser callback at a loopback address on your computer. The client must be running and listening on the exact registered port. A browser on a different device cannot reach that local listener. Use the callback supplied by the client.
If Tor Browser blocks the local return, follow the scoped troubleshooting instructions. Avoid global browser-protection changes. Never share a callback URL containing an authorization code.
Verify the completed connection
A callback-received message proves only that the browser reached the client. Wait for token exchange and MCP connection to complete, then perform a read-only operation permitted by your grant. Inspect the client’s transport configuration and redacted diagnostics to confirm the intended endpoint and proxy.
Use an isolated test session when checking failure behavior; an unavailable proxy must produce an error, not a direct connection. A successful tool result alone does not prove which transport carried it.
Manage unwanted grants under Impreza API, Connected Apps. Revocation does not undo completed actions. Continue with OAuth permissions or publish an onion app once the connection is verified.