# Connect an agent (OAuth)

> Add the server to Cursor, Claude, ChatGPT, or Codex and authorize with your Clad login — no keys to copy.

Product: Clad MCP
Source: https://docs.useclad.ai/mcp/connect-agent

---

Add the server to your client and complete the sign-in prompt — there are no keys
to copy.

**Cursor** — add to `~/.cursor/mcp.json` (or `.cursor/mcp.json` in a project):

```json
{
  "mcpServers": {
    "clad": { "url": "https://clad-server-production.up.railway.app/mcp" }
  }
}
```

**Claude Code**:

```bash
claude mcp add --transport http clad https://clad-server-production.up.railway.app/mcp
```

**Other clients** — Claude Desktop custom connectors, VS Code, and ChatGPT
developer mode all accept the same URL. Copy-ready snippets for each live in
**Settings → MCP**.

### The sign-in flow

On first connect your agent opens a browser window:

1. Sign in with your Clad account.
2. Pick the workspace to connect.
3. Review the exact scopes the agent requested, then authorize.

Clad runs a full **OAuth 2.1** authorization server — PKCE, dynamic client
registration, refresh-token rotation with reuse detection, and RFC 8707 resource
audiencing — the flow your client drives automatically. You never paste a secret.

### Acting as you

An OAuth connection acts on your behalf: issues you reply to and records you
create are attributed to **you**, not to the agent's name. The connection's
identity (e.g. "Cursor") is only used for the audit trail of which agent made the
call.

### Live role enforcement

Grants follow your role **live**: if you are demoted or removed from the
workspace, the agent's tokens and refreshes are clamped or revoked immediately —
an agent never keeps powers its owner lost. Review and disconnect agents anytime
from **Settings → MCP → Connected agents**; disconnecting takes effect instantly.