Turning it on↑ Why · Sam lets an AI help, and decides what it sees Sam turns it on from settings, sees what the agent will get, and pastes one line into the agent.
MCP is off until you turn it on
A door nobody asked for is one nobody watches.
Shown when on a fresh node nothing answers MCP, and the client command refuses, saying where to turn it on.
How Settings
Not built: nothing in the code or tests names this yet.
One switch turns it on with the default grants, shown first
Setting up an agent shouldn't take a page of choices, and what it gets shouldn't be a surprise.
Shown when turning MCP on in settings, for a new client, lists its grants; confirming once makes the client and its grants, and the client's first call works.
How Settings
Not built: nothing in the code or tests names this yet.
By default a client reads this node's kept folders, and its writes ask
Most of what an agent does is read; what it changes, you want to see.
Shown when with the defaults, a read of a kept folder on this node runs, a write waits for an answer, a read elsewhere is refused, and no shell, other node or internet is offered.
How Settings
Not built: nothing in the code or tests names this yet.
The page gives the line for your agent
The last step is the one people give up on.
Shown when the line the page shows for Claude Code and for Codex, run as shown, gives each client the tools; the page also shows the command and arguments for any client that takes a command.
Not built: nothing in the code or tests names this yet.
Each client is a key of its own, removed on its own
Two agents must not share a yes.
Shown when two clients with different grants each get their own; removing one leaves the other working, and its next call is refused.
How Settings
Not built: nothing in the code or tests names this yet.
What a client sees↑ Why · Sam lets an AI help, and decides what it sees The agent sees only the verbs its grant allows, and what it changes waits for Sam.
A client sees only the verbs its grants allow
A tool listed and then refused is a tool an agent keeps trying.
Shown when a client granted reading on one folder lists reading tools only, on that node only.
How Tools
Not built: nothing in the code or tests names this yet.
A client reaches other nodes as itself, checked there
The machine with the folder decides, not the node the agent runs beside.
Shown when given a folder on another machine, a client reads it through this node; that machine's audit names the client, not this node.
How Tools
Not built: nothing in the code or tests names this yet.
A call that asks comes back pending, and the answer comes later
An agent that blocks for minutes looks broken, and one that gives up loses the work.
Shown when a write under ask returns pending within 30 seconds; answered on a phone, the client's wait returns the write's result. A yes typed into the client's own prompt approves nothing.
Not built: nothing in the code or tests names this yet.
The door is a command on this machine, never a port
A port on localhost is reachable by every user of the machine and by any web page that finds it.
Shown when with MCP on, the node listens on no TCP or UDP port for it, and another OS user can't reach it.
Not built: nothing in the code or tests names this yet.