Skip to main content
The remote MCP endpoint is:
It exposes one read-only tool:

Create an MCP access token

Create an API key with agents:read, then exchange its client ID and one-time ck_ secret for a token bound to the MCP resource.
The token expires after one hour. Request a new token before reconnecting after expiry.

Configure your client

Use Streamable HTTP and send the token as a bearer credential:
For Codex, use the equivalent environment-backed bearer token setting:
Do not place the client secret or bearer token directly in a committed configuration file. The endpoint does not accept long-lived ck_ secrets.

OAuth discovery

MCP clients can discover the authentication contract from:
MCP tokens accept only agents:read. Use a separate REST token with chat:write for agent conversations.