authorgravatar for julius0216@outlook.comJulius Marminge <julius0216@outlook.com> 2026-10-06 23:16:52-07:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2026-10-06 23:16:52-07:00
log0f4f02abb6ab5428c06a7e4b6c76b3ec84c62498
tree52a1c3b286d485c6fad43408206f6b8fc4be364d
parent10f39eb9ac80c9a4b7f5097575dd2addc3b6f631
signature Signed by PGP key B5690EEEBB952194

docs: connect Claude Code, Codex, ChatGPT and bots over MCP (#16741)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

4 files changed, 99 insertions(+), 25 deletions(-)

README.md+1
...@@ -94,6 +94,7 @@ Full docs live in [docs/](./docs). There's no docs site yet....@@ -94,6 +94,7 @@ Full docs live in [docs/](./docs). There's no docs site yet.
94- [Project settings](./docs/user/project-settings.md)94- [Project settings](./docs/user/project-settings.md)
95- [Appearance preferences](./docs/user/appearance.md)95- [Appearance preferences](./docs/user/appearance.md)
96- [Remote access from a phone or another machine](./docs/user/remote-access.md)96- [Remote access from a phone or another machine](./docs/user/remote-access.md)
97- [Connect Claude Code, Codex, ChatGPT and other agents over MCP](./docs/user/outside-agents.md)
97- [Keeping app and server in sync](./docs/user/updating.md)98- [Keeping app and server in sync](./docs/user/updating.md)
98- [Source control integrations](./docs/user/source-control.md)99- [Source control integrations](./docs/user/source-control.md)
99- Multiple accounts: [Codex](./docs/user/providers-codex.md) · [Claude](./docs/user/providers-claude.md)100- Multiple accounts: [Codex](./docs/user/providers-codex.md) · [Claude](./docs/user/providers-claude.md)
docs/README.md+1
...@@ -18,6 +18,7 @@...@@ -18,6 +18,7 @@
18- [Usage and limits](./user/usage.md)18- [Usage and limits](./user/usage.md)
19- [Product usage data](./user/telemetry.md)19- [Product usage data](./user/telemetry.md)
20- [Remote access](./user/remote-access.md)20- [Remote access](./user/remote-access.md)
21- [Outside agents (MCP)](./user/outside-agents.md)
21- [Running in the background](./user/background-service.md)22- [Running in the background](./user/background-service.md)
22- [Updating T3 Code](./user/updating.md)23- [Updating T3 Code](./user/updating.md)
23- Provider guides: [Codex](./user/providers-codex.md) · [Claude](./user/providers-claude.md) · [OpenCode](./user/providers-opencode.md) · [Antigravity](./user/providers-antigravity.md) · [Pi](./user/providers-pi.md)24- Provider guides: [Codex](./user/providers-codex.md) · [Claude](./user/providers-claude.md) · [OpenCode](./user/providers-opencode.md) · [Antigravity](./user/providers-antigravity.md) · [Pi](./user/providers-pi.md)
docs/user/outside-agents.md created+94
...@@ -0,0 +1,94 @@
1# Outside agents
2
3Agents that T3 Code did not start can work with an environment through its MCP
4server. They can read projects and threads, start and message threads, and
5check which providers and models are available. This covers Claude Code or
6Codex in your own terminal, ChatGPT, and bots that support MCP. Each agent signs
7in once, and you choose what it may do.
8
9## Get the MCP URL
10
11In **Settings → Connections**, open a saved environment's menu and choose
12**Copy MCP URL**. The URL is the environment's address followed by `/mcp`, for
13example:
14
15```text
16https://<environment-address>/mcp
17```
18
19The address must use HTTPS, or `localhost` when the agent runs on the host
20itself. Agents refuse to sign in over a plain `http://` LAN or tailnet address.
21
22- **An agent on your own computers** can use T3 Connect, Tailscale HTTPS, or
23 `localhost` on the host. See [remote access](./remote-access.md).
24- **A hosted agent**, such as ChatGPT or a bot running in the cloud, must reach
25 the environment from the internet. Use the T3 Connect address. A Tailscale
26 address only works from your own tailnet.
27
28## Approve a sign-in
29
30The first time an agent connects, it opens a sign-in page on the environment.
31The page names the agent and where its access goes:
32
33- For an agent on your computer, approval returns to a `localhost` address on
34 the computer that opened the page.
35- For a hosted agent, approval goes to that service, such as `chatgpt.com`.
36 Anyone who runs that service gets the access.
37
38Only approve a sign-in you just started. To approve, enter a pairing code from
39**Settings → Connections** or from `t3 auth pairing create` on the host. A
40browser already signed in to the environment as an administrator can approve
41without a code.
42
43Then choose what the agent may do:
44
45- **Read only** is the default. The agent can read projects and threads and see
46 the available providers and models. It cannot change anything.
47- **Supervised** through **Full access** also let it start, message and stop
48 threads in every project. A thread it starts or steers cannot run with more
49 permissions than the mode you chose.
50
51## Claude Code
52
53```sh
54claude mcp add --transport http t3 https://<environment-address>/mcp
55claude mcp login t3
56```
57
58`claude mcp login` opens the sign-in page in your browser. On a machine
59without a browser, add `--no-browser`, open the printed URL elsewhere, and
60paste the final URL back when asked. `claude mcp list` shows `t3` as connected
61once you approve.
62
63## Codex
64
65```sh
66codex mcp add t3 --url https://<environment-address>/mcp
67codex mcp login t3
68```
69
70`codex mcp login --no-browser` prints the sign-in URL instead of opening it.
71`codex mcp list` shows `t3` with OAuth once you approve.
72
73## ChatGPT
74
75Add the environment as a custom MCP app in ChatGPT's apps settings:
76
771. Create a new app or plugin with a custom MCP server.
782. Set the server URL to `https://<environment-address>/mcp`, using the T3
79 Connect address.
803. Choose **OAuth** for authentication. ChatGPT discovers the rest; you do not
81 need a client ID or secret.
824. Create the app, then approve the sign-in page that opens.
83
84## Other agents and bots
85
86Any agent that supports remote MCP servers over HTTP with OAuth can connect. Give
87it the MCP URL and choose OAuth, and the agent finds the sign-in settings itself.
88Agents without OAuth support cannot connect.
89
90## Remove an agent
91
92Approved agents appear under **Settings → Connections** like other clients.
93Revoke one there to cut off its access immediately. A sign-in lasts 30 days;
94after that the agent asks you to approve it again.
docs/user/remote-access.md+3-25
...@@ -222,31 +222,9 @@ set `T3CODE_SERVER_BROWSER_SANDBOX=0` for the environment to run without it....@@ -222,31 +222,9 @@ set `T3CODE_SERVER_BROWSER_SANDBOX=0` for the environment to run without it.
222222
223## Connect an outside agent223## Connect an outside agent
224224
225An agent T3 Code did not start, such as Claude Code in your own terminal, can225Claude Code, Codex, ChatGPT and other agents T3 Code did not start can drive
226drive threads on an environment through its MCP server. In **Settings →226threads on an environment through its MCP server. See
227Connections**, open a saved environment's menu and choose **Copy MCP URL**, then227[outside agents](./outside-agents.md) for setup.
228add it to the agent. For example:
229
230```sh
231claude mcp add --transport http t3 https://<environment-address>/mcp
232```
233
234The first time the agent connects, it opens a sign-in page on the environment.
235Enter a pairing code from **Settings → Connections** on a device that can manage
236access, or from `t3 auth pairing create` on the host, and choose what the agent
237may do. A browser already signed in to that environment as an administrator can
238approve without a code.
239
240- **Read only** lets the agent read projects and threads in every project, and
241 see which providers and models are available. It cannot change anything.
242- **Supervised** through **Full access** also let it start, message and stop
243 threads in every project, but it cannot start or steer a thread with more
244 permissions than the mode you chose.
245
246Use an HTTPS address: T3 Connect, Tailscale Serve, or `localhost` on the host
247itself. Agents refuse to sign in through a plain `http://` LAN or tailnet
248address. The agent appears under **Settings → Connections** like any other
249client; revoke it there. Sign-ins last 30 days.
250228
251## Manage or revoke access229## Manage or revoke access
252230