Connect an agent in one line

Agents and MCPMCP/mcpauth.oauthServerLT_OAUTH_ISSUERallowedRedirectUris

Add the /mcp URL to any MCP client, sign in once in the browser, and the agent acts as you with your roles as they are now.

The situation

A person wants Claude Code, Claude Desktop or another MCP client to work the queues they already work. They should not copy a key into a file, and the client should never be able to do more than they can.

The recipe

Enable the OAuth server on the deployment:

start({
  auth: {
    oauthServer: {
      issuer: 'https://lt.acme.dev',
      allowedRedirectUris: ['https://claude.ai/api/mcp/auth_callback'],
    },
  },
});

Then add the endpoint to the client:

claude mcp add --transport http long-tail https://lt.acme.dev/mcp

Run /mcp in Claude Code and pick Authenticate. The consent page shows the app, the account and where it returns, and offers two choices:

Choice	The client may
Allow read-only	Read what you can read, and run workflows marked read-safe
Allow as me	Do anything you can do, wherever your roles allow

Clients register themselves (RFC 7591). Loopback redirects are always allowed; an https redirect must equal an entry in allowedRedirectUris.

The guarantee

The client acts as you: every result is limited to your roles and every action is recorded as you. Access tokens last 5 minutes and refresh with a rotating refresh token. Every request reads the grant, so a disconnected app, a revoked token or a deactivated account stops working on the next request. See MCP.

Agents and MCP