--- title: Connect your agent description: Add the looot MCP server to any agent client, sign in with the browser or a header token, and see what the consent page shows. sidebar: label: Overview --- Agents reach looot over MCP (Streamable HTTP) at one URL: ```txt https://api.looot.ai/mcp ``` The agent gets the same catalog, balance and runs as the CLI. There are two ways to sign in. - **Browser sign-in (the default).** Add the URL to your client and start its sign-in. A browser opens on looot.ai, you pick the organization and click **Connect**. The client keeps its own token and renews it while you're connected. You never see or copy a key. - **A token in the header (the fallback).** Send `Authorization: Bearer ` with every request. Use it for CI, scripts, and clients that can't open a browser. The token comes from Settings, **Agent tokens**, on looot.ai. See [Headless: CI and scripts](/connect/headless). Both ways give the agent a normal looot token, scoped to what you chose, billed to one organization, listed in Settings, **Agent tokens**, and revocable there. Before the first paid run, top up the organization's balance. See [Before your first run](/money#before-your-first-run). ## Pick your client Other pages: [Headless: CI and scripts](/connect/headless), [looot init](/connect/looot-init), [Troubleshooting](/connect/troubleshooting). ### Other MCP clients Any client that takes a remote MCP URL can reach looot. These have no page of their own yet and are not tested by hand; use the URL above, or the [mcp-remote bridge](/connect/mcp-remote) for a client that only runs local servers. Client names and logos are trademarks of their owners. They are shown here only to say which clients looot works with; it doesn't mean those companies endorse looot. ## Which clients are tested "Tested" means someone clicked through the client's own sign-in by hand and checked the tools loaded. Everything else is "not tested by hand yet": the install steps follow the client's own docs, but nobody has verified them end to end. | Client | Status | | --- | --- | | Claude Code | Tested by hand | | claude.ai, Claude Desktop | Not tested by hand yet | | ChatGPT | Not tested by hand yet | | Codex | Not tested by hand yet | | Cursor | Not tested by hand yet | | VS Code | Not tested by hand yet | | Gemini CLI | Not tested by hand yet | | Windsurf | Not tested by hand yet | | Grok | Not tested by hand yet | | Copilot Studio | Not tested by hand yet | | Muse | Not tested by hand yet | | mcp-remote | Not tested by hand yet | ## The consent page The client opens `looot.ai/oauth/consent`. If you're signed out, looot.ai asks you to sign in first and brings you back to the same request. The page is titled **Connect an app** and shows: - **Connect *app name* to looot?** The name the client registered with. If the client registered itself, the page says looot did not verify who is behind it. A client that publishes a signed client document, such as Claude Code, shows as verified. - **Credentials will be sent to**, the address the client gets the result on. For an app on your own computer that's `localhost` or `127.0.0.1` with a port, and the page adds a warning to click Cancel if you didn't just start that connection. For a hosted client it's that client's own site, such as `claude.ai` or `chatgpt.com`. - **Signed in as**, your email. - **Organization**, with its balance. Calls made through this connection spend this organization's balance. If you belong to more than one, pick another one here. - **Scopes**, checkboxes for what the agent may do. Only scopes your account can grant are listed. `catalog.read`, `runs.read`, `runs.execute` and `usage.read` are ticked by default, which is what an agent needs to search, run and check the balance. See the scope table below. - **Stay connected for**, a duration you pick, with 30 days as the default. - **Connect** and **Cancel**. Only an owner or admin of the organization can click **Connect**. After **Connect**, the browser goes back to the client, and the client finishes on its own. If the browser doesn't switch back, the page shows a "return to *app name*" link. What happens next: - The client holds an access token and renews it in the background until the duration you picked runs out. Then it asks you to sign in again. - The token appears in Settings, **Agent tokens**, as "*app name* (connected)", for example "Claude Code (connected)". - Revoke it there any time. The client's next call gets a 401 and its next renewal fails, so it asks you to sign in again. **Cancel** sends the client an `access_denied` answer. Nothing is created. ## Token scopes | Scope | What it lets the token do | | --- | --- | | `catalog.read` | Search and read the catalog: jobs, endpoints, prices and coverage. | | `runs.read` | Read runs, their status, results and evidence. | | `runs.execute` | Start and cancel runs, which spends the organization's balance. | | `usage.read` | Read balance and usage. | | `connections.read` | Read connected accounts, such as an org's own connected provider keys. | | `workflows.read` | Read saved workflows. | | `workflows.execute` | Run saved workflows. | ## Set up any client with one paste Some agents can read a URL and configure themselves. Paste this into the chat: ```txt Set up looot: read https://api.looot.ai/llms.txt and follow it. ```