Set up an MCP client

Connect Codex, Claude Code, Claude Desktop, Cursor, or VS Code to Management MCP.

Every client connects to the same stateless Streamable HTTP endpoint: https://cms.example.com/agent/mcp. Replace the host with your Management API origin.

Open Connect an agent app from Overview or Connections. Choose Codex, Claude Code, Cursor, or VS Code (GitHub Copilot) for app-specific commands or configuration, browser sign-in steps, and an official setup guide. Other provides the remote HTTP endpoint. Each example uses your installation’s endpoint and OAuth without a static key. Setup then checks your Organization connections. Copy Backend context preserves the originating Backend and Environment for your next request; View exact copied instructions reveals the complete text and IDs. This text guides the agent; it does not narrow the OAuth credential’s permissions. How access works explains the role boundary and optional Agent Auth flow.

Pick one credential:

Agent key — paste x-api-key as a static header. Unattended, Organization-owned, permissions fixed at creation. Create it in Settings → Organization keys.
OAuth 2.1 — no header; the client runs the Authorization Code flow and you approve in the browser. Calls then use your own live permissions.

Codex

With the Codex CLI installed, run:

codex mcp add jetrepo --url 'https://cms.example.com/agent/mcp'
codex mcp login jetrepo

Use your installation’s endpoint. If the server is already configured, use its existing name for login. Check the requesting app and Organization in the consent page before authorizing. Return to Jetrepo to check the connection and copy the scoped working context, then continue in Codex. An authorized Organization connection and successful work in a particular Environment are separate pieces of evidence.

Claude Code

With Claude Code installed, add Jetrepo for your user account:

claude mcp add --transport http --scope user jetrepo 'https://cms.example.com/agent/mcp'

Then run /mcp inside Claude Code, select jetrepo, and authenticate in your browser. If the server is already registered, continue with /mcp using its existing name.

Use --scope user for every project, --scope project to write a shared .mcp.json (key-free — OAuth only), or the default local scope for this project only. A project-scoped file looks like:

{
  "mcpServers": {
    "jetrepo": {
      "type": "http",
      "url": "https://cms.example.com/agent/mcp"
    }
  }
}

Verify with claude mcp list, then ask Claude to call inspect with kind: "BACKENDS". It returns only Backends visible to the delegated human.

Claude Desktop

Open Settings → Connectors → Add custom connector, enter https://cms.example.com/agent/mcp, and complete the browser sign-in. Desktop connectors use OAuth; there is no field for a static x-api-key.

Custom remote connectors connect from Anthropic’s cloud, so your Management endpoint must be reachable from there. A server reachable only on your laptop is insufficient for this connector flow. See the official remote connector guide.

Cursor

Add the server to ~/.cursor/mcp.json (global) or .cursor/mcp.json (project):

{
  "mcpServers": {
    "jetrepo": {
      "url": "https://cms.example.com/agent/mcp"
    }
  }
}

Keep any existing entries under mcpServers. Save the file and restart Cursor. Open Customize → MCPs, enable jetrepo, and follow its authentication prompt. After browser sign-in, check its tools in Agent chat.

VS Code with GitHub Copilot

Open .vscode/mcp.json in the workspace, or run MCP: Open Workspace Folder Configuration from the Command Palette. Add the jetrepo entry without replacing existing servers:

{
  "servers": {
    "jetrepo": {
      "type": "http",
      "url": "https://cms.example.com/agent/mcp"
    }
  }
}

Select Start above the entry, or run MCP: List Servers and choose jetrepo. Confirm server trust and complete browser sign-in. Open Copilot Chat and check Configure Tools for Jetrepo.

Any other client

Anything that speaks Streamable HTTP works. Point it at /agent/mcp, send either x-api-key: YOUR_AGENT_KEY or Authorization: Bearer …, and let it discover authorization from /.well-known/oauth-protected-resource.

Check the connection

tools/list — returns the four canonical operations allowed to the credential.
inspect with kind: "ORGANIZATIONS" — confirms live delegated membership and whether Backend creation is available.
For an empty Organization, inspect OPERATION_DEFINITIONS with its Organization ID to discover backend.create@1. For existing work, inspect BACKENDS, then ENVIRONMENTS, then definitions with the exact Backend and Environment.

An empty tool list or permission-filtered inspection means the credential is missing live access, not that the server is broken. A 401 with a WWW-Authenticate header means the credential was rejected or revoked; see MCP authentication.