Connect an agent

Add it the way you add any remote MCP server, as a Streamable HTTP server. In Claude Desktop, open Settings, then Connectors, and choose Add custom connector. In a terminal agent, one command does it:

# Claude Code
claude mcp add --transport http meandr https://calm-otter.meandr.io
# Codex
codex mcp add meandr --url https://calm-otter.meandr.io

A client set up with a JSON file, such as .mcp.json, takes the same URL:

{
  "mcpServers": {
    "meandr": {
      "type": "http",
      "url": "https://calm-otter.meandr.io"
    }
  }
}

Agents that support OAuth open your browser the first time they connect. Sign in to Meandr, then choose which agent this is, or create a new one in the same step. Claude Desktop works this way, and so does any client that registers itself with OAuth Dynamic Client Registration (DCR) or Client ID Metadata Documents (CIMD). There is nothing to copy back into the client.

That's it for most agents. The agent now sees every tool the workspace allows, and every call it makes goes through the workspace's policies.

Some clients want a key, or OAuth client credentials of their own. Register those agents first. In Add agent, give it a name and, if you like, tags. Policies can match agents by tag, which is handy for treating a group of agents alike.

Then open the agent and answer one question: what does your client ask for, in addition to the URL?

A Bearer token. Click Add key and copy the token. It is shown only once. Your client sends it in an Authorization header:

claude mcp add --transport http meandr https://calm-otter.meandr.io \
  --header "Authorization: Bearer tok_…"

In a JSON config, it goes under "headers":

{
  "mcpServers": {
    "meandr": {
      "type": "http",
      "url": "https://calm-otter.meandr.io",
      "headers": {
        "Authorization": "Bearer tok_…"
      }
    }
  }
}

A Client ID, or a Client ID and a Secret. Click Generate and paste what you get into the client's OAuth settings. They can't be changed later without deleting the client, so generate them when you are ready to paste them.

Codex and Claude Code connect either way. They sign in with OAuth as in step 3, or use a bearer token if you would rather set one.

Every agent has its own page. It shows the connection URL, the agent's access keys and when each was last used, its OAuth clients, and the client software that connected as it in the last day, with versions and call counts.

Revoke a key and Meandr stops accepting it at once. Your servers' credentials never leave Meandr, so nothing else needs changing. The same page lets you give one agent a rate limit of its own, apart from the workspace's.