# Connecting a coding agent over MCP

The hosted MCP server is `https://api.anlyon.com/mcp` (streamable HTTP). It signs in with OAuth ("Login with Anlyon"): no key to paste. On the consent screen the user picks the workspace, the environment and the permission groups. "Approve on your behalf" is off unless they turn it on.

Each integration also has its own server, `https://api.anlyon.com/mcp/<integration>` (for example `/mcp/github`). It serves that integration's turned-on actions plus `check_approval` and `wait_for_approval`, and nothing else.

## Claude Code

```bash
claude mcp add --transport http anlyon https://api.anlyon.com/mcp
```

Then run `/mcp` inside Claude Code, select `anlyon`, and authenticate in the browser. Add `--scope user` to make it available in every project.

## Cursor

`.cursor/mcp.json` in the project, or `~/.cursor/mcp.json` for every project:

```json
{ "mcpServers": { "anlyon": { "url": "https://api.anlyon.com/mcp" } } }
```

Cursor then asks the user to sign in.

## Codex

`~/.codex/config.toml`:

```toml
[mcp_servers.anlyon]
url = "https://api.anlyon.com/mcp"
```

Then `codex mcp login anlyon`.

## Without a browser (CI, headless)

Use an API key read from the environment. Never write the key into a file: each client below expands the variable when it starts. Do not pass the key as a `claude mcp add --header` argument; the shell expands it and the literal key is saved to the config.

Claude Code, `.mcp.json`:

```json
{ "mcpServers": { "anlyon": { "type": "http", "url": "https://api.anlyon.com/mcp", "headers": { "Authorization": "Bearer ${ANLYON_API_KEY}" } } } }
```

Cursor, `.cursor/mcp.json`:

```json
{ "mcpServers": { "anlyon": { "url": "https://api.anlyon.com/mcp", "headers": { "Authorization": "Bearer ${env:ANLYON_API_KEY}" } } } }
```

Codex, `~/.codex/config.toml`:

```toml
[mcp_servers.anlyon]
url = "https://api.anlyon.com/mcp"
bearer_token_env_var = "ANLYON_API_KEY"
```

Or the local package over stdio, in `.mcp.json`:

```json
{
  "mcpServers": {
    "anlyon": {
      "command": "npx",
      "args": ["-y", "@anlyonhq/mcp-server"],
      "env": { "ANLYON_API_KEY": "${ANLYON_API_KEY}" }
    }
  }
}
```

The key's scopes are exactly what the agent can do. Give it Standard, not Full access.

## Tools the server exposes

| Tool | Use |
| --- | --- |
| `list_actions` | The workspace's actions, input schemas, and which need approval |
| `invoke_action`, `action_<name>` | Invoke an action. Each enabled action is also its own tool |
| `request_approval` | Ask a person before a step that is not an action |
| `check_approval` | Read an approval once |
| `wait_for_approval` | Wait for a decision, up to 120 seconds a call (60 by default). Call again while it is still `pending` |
| `list_pending_approvals`, `decide_approval` | Reviewer tools. Need "Approve on your behalf" (OAuth) or `approvals:decide` (key). Never for the agent's own requests |
| `list_workspaces`, `select_workspace` | Switch workspace or environment (OAuth) |

MCP clients change their commands between releases. If a command is refused, check the client's MCP documentation.