Connect your agent

The copied prompt contains a secret. Your clipboard and agent chat may retain it. Use manual setup to keep the key out of chat. Keys expire after 90 days. You can copy or revoke an active key under Manage connections.

Keep credentials outside repositories and restrict access to private configuration files.

Merge into your user configuration, usually ~/.codex/config.toml.

[mcp_servers.decret]
url = "https://decret.ai/api/mcp"
http_headers = { Authorization = "Bearer YOUR_CONNECTION_KEY" }

You can use bearer_token_env_var = "DECRET_MCP_KEY" instead if the environment launching Codex supplies it. A terminal export does not reach an already running desktop app.

Official Codex documentation ↗

Merge into your private user configuration at ~/.cursor/mcp.json.

{
  "mcpServers": {
    "decret": {
      "url": "https://decret.ai/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_CONNECTION_KEY"
      }
    }
  }
}

Cursor also accepts ${env:DECRET_MCP_KEY} in the Authorization header if its environment supplies the variable. Enable or reload the server in MCP settings.

Official Cursor documentation ↗

Use user scope in ~/.claude.json, or claude mcp add-json with --scope user.

{
  "mcpServers": {
    "decret": {
      "type": "http",
      "url": "https://decret.ai/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_CONNECTION_KEY"
      }
    }
  }
}

Claude Code requires type: "http". With claude mcp add-json --scope user decret, pass only the inner server object. Avoid literal keys in shell history. Check /mcp in a new session.

Official Claude Code documentation ↗

Merge into your private user configuration at ~/.gemini/settings.json.

{
  "mcpServers": {
    "decret": {
      "httpUrl": "https://decret.ai/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_CONNECTION_KEY"
      },
      "trust": false
    }
  }
}

Use httpUrl for Streamable HTTP; url selects SSE. Keep trust: false to preserve tool confirmations and check /mcp after setup.

Official Gemini CLI documentation ↗

Client configuration was checked against official documentation on September 7, 2026. Cursor CLI tool discovery also passed against the local service. The HTTP service is tested with the official MCP SDK; this does not establish compatibility with every client release or managed environment. Other clients must support Streamable HTTP and bearer headers. Antigravity and Grok do not yet have individually verified guides here. OAuth-only connectors need a future integration.

Company read access exposes company_get, document_read and research_catalog. Edit access adds company_update, document_put and document_delete. The decret://company resource returns the profile and document list. Optional research access adds research_list, research_start, research_status, research_read and research_stop. It lets the connection use your allowance for board questions and read research history, including private company quotes. Existing keys keep research disabled until you enable it in Agent link. Connections cannot change billing, select another account or alter the shared library.

Notebook access is separate: none, read, or edit. Existing connections have no notebook access. Agent notes carry the connection name. Saving a passage from an answer also requires research history access. Notes are not automatically added to company context or research questions. Read the notebook guide ↗

Research runs continue after the client disconnects. Read complete results with citations in pages; stop individual questions explicitly. Turning access off does not cancel work already started. Read the research guide ↗

Open a document under Company → Details & documents to read or edit its saved text. If an agent changed it while you were editing, your draft is kept for comparison. Put business-specific facts in your company context or documents.

Send UTF-8 Text or Markdown, up to 512 KiB per document and 10 documents per company. There is no server PDF/Word extraction or URL fetching. An authorized agent can extract those formats locally, check the resulting text, then upload it. A filename or website URL alone does not import its contents.

Use a stable externalId such as company/strategy. Read existing versions before changing anything; expectedVersion 0 creates a profile or document, and later writes require the current version. A document replacement sends its entire text. On conflict, reread and reconcile human edits. For long documents, pass the first page’s version as expectedVersion with each nextOffset. If it changes, discard those pages and restart. Deletion also requires the current version and the user's intent.

The endpoint is your Decret web origin followed by /api/mcp. Use Streamable HTTP and an Authorization bearer header. Localhost works only for agents on the same computer. Hosted agents need a reachable HTTPS deployment. Decret does not open a tunnel, publish a marketplace plugin or perform OAuth login in this preview.

If setup is saved but tools are absent, reload the client or start a new session. Verify by calling company_get. A 401 means the key is missing, expired or revoked; a 429 means wait before retrying. Key activity on the website confirms authentication, not that company uploads completed.