| ... | ... | @@ -0,0 +1,94 @@ |
| 1 | # Outside agents |
| 2 | |
| 3 | Agents that T3 Code did not start can work with an environment through its MCP |
| 4 | server. They can read projects and threads, start and message threads, and |
| 5 | check which providers and models are available. This covers Claude Code or |
| 6 | Codex in your own terminal, ChatGPT, and bots that support MCP. Each agent signs |
| 7 | in once, and you choose what it may do. |
| 8 | |
| 9 | ## Get the MCP URL |
| 10 | |
| 11 | In **Settings → Connections**, open a saved environment's menu and choose |
| 12 | **Copy MCP URL**. The URL is the environment's address followed by `/mcp`, for |
| 13 | example: |
| 14 | |
| 15 | ```text |
| 16 | https://<environment-address>/mcp |
| 17 | ``` |
| 18 | |
| 19 | The address must use HTTPS, or `localhost` when the agent runs on the host |
| 20 | itself. Agents refuse to sign in over a plain `http://` LAN or tailnet address. |
| 21 | |
| 22 | - **An agent on your own computers** can use T3 Connect, Tailscale HTTPS, or |
| 23 | `localhost` on the host. See [remote access](./remote-access.md). |
| 24 | - **A hosted agent**, such as ChatGPT or a bot running in the cloud, must reach |
| 25 | the environment from the internet. Use the T3 Connect address. A Tailscale |
| 26 | address only works from your own tailnet. |
| 27 | |
| 28 | ## Approve a sign-in |
| 29 | |
| 30 | The first time an agent connects, it opens a sign-in page on the environment. |
| 31 | The page names the agent and where its access goes: |
| 32 | |
| 33 | - For an agent on your computer, approval returns to a `localhost` address on |
| 34 | the computer that opened the page. |
| 35 | - For a hosted agent, approval goes to that service, such as `chatgpt.com`. |
| 36 | Anyone who runs that service gets the access. |
| 37 | |
| 38 | Only approve a sign-in you just started. To approve, enter a pairing code from |
| 39 | **Settings → Connections** or from `t3 auth pairing create` on the host. A |
| 40 | browser already signed in to the environment as an administrator can approve |
| 41 | without a code. |
| 42 | |
| 43 | Then choose what the agent may do: |
| 44 | |
| 45 | - **Read only** is the default. The agent can read projects and threads and see |
| 46 | the available providers and models. It cannot change anything. |
| 47 | - **Supervised** through **Full access** also let it start, message and stop |
| 48 | threads in every project. A thread it starts or steers cannot run with more |
| 49 | permissions than the mode you chose. |
| 50 | |
| 51 | ## Claude Code |
| 52 | |
| 53 | ```sh |
| 54 | claude mcp add --transport http t3 https://<environment-address>/mcp |
| 55 | claude mcp login t3 |
| 56 | ``` |
| 57 | |
| 58 | `claude mcp login` opens the sign-in page in your browser. On a machine |
| 59 | without a browser, add `--no-browser`, open the printed URL elsewhere, and |
| 60 | paste the final URL back when asked. `claude mcp list` shows `t3` as connected |
| 61 | once you approve. |
| 62 | |
| 63 | ## Codex |
| 64 | |
| 65 | ```sh |
| 66 | codex mcp add t3 --url https://<environment-address>/mcp |
| 67 | codex mcp login t3 |
| 68 | ``` |
| 69 | |
| 70 | `codex mcp login --no-browser` prints the sign-in URL instead of opening it. |
| 71 | `codex mcp list` shows `t3` with OAuth once you approve. |
| 72 | |
| 73 | ## ChatGPT |
| 74 | |
| 75 | Add the environment as a custom MCP app in ChatGPT's apps settings: |
| 76 | |
| 77 | 1. Create a new app or plugin with a custom MCP server. |
| 78 | 2. Set the server URL to `https://<environment-address>/mcp`, using the T3 |
| 79 | Connect address. |
| 80 | 3. Choose **OAuth** for authentication. ChatGPT discovers the rest; you do not |
| 81 | need a client ID or secret. |
| 82 | 4. Create the app, then approve the sign-in page that opens. |
| 83 | |
| 84 | ## Other agents and bots |
| 85 | |
| 86 | Any agent that supports remote MCP servers over HTTP with OAuth can connect. Give |
| 87 | it the MCP URL and choose OAuth, and the agent finds the sign-in settings itself. |
| 88 | Agents without OAuth support cannot connect. |
| 89 | |
| 90 | ## Remove an agent |
| 91 | |
| 92 | Approved agents appear under **Settings → Connections** like other clients. |
| 93 | Revoke one there to cut off its access immediately. A sign-in lasts 30 days; |
| 94 | after that the agent asks you to approve it again. |