# Connect a client

> Connect Claude, Cursor or Codex to the hosted MCP endpoint in one line.

Connect an MCP client to `https://<tenant id>.atlanticagenticlabs.com/mcp` with a machine key and your tenant’s Access service token. First issue a `viewer` key (**Settings → API keys**) and set:

```bash
export AAL_TENANT="<tenant id>"
export AAL_KEY="aalcp-..."
export CF_ACCESS_CLIENT_ID="<client id>"
export CF_ACCESS_CLIENT_SECRET="<client secret>"
```

See [Authentication](/api/authentication/) for the key and the token.

## Claude

Claude Code, in one line:

```bash
claude mcp add --transport http lighthouse "https://$AAL_TENANT.atlanticagenticlabs.com/mcp" \
  --header "Authorization: Bearer $AAL_KEY" \
  --header "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
  --header "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET"
```

`claude mcp list` shows `lighthouse` as connected. Add `--scope user` to use it in every project.

Claude’s desktop and web apps add remote servers as connectors that sign in with OAuth. That needs [OAuth on the endpoint](/mcp/#signing-in-with-oauth), which is \[Coming].

## Cursor

In `.cursor/mcp.json` in your home directory (every project) or in a project’s root (that project), with your own values in place of the placeholders:

```json
{
  "mcpServers": {
    "lighthouse": {
      "url": "https://<tenant id>.atlanticagenticlabs.com/mcp",
      "headers": {
        "Authorization": "Bearer aalcp-...",
        "CF-Access-Client-Id": "<client id>",
        "CF-Access-Client-Secret": "<client secret>"
      }
    }
  }
}
```

Keep the file out of version control: it holds a key.

## Codex

In `.codex/config.toml` in your home directory, reading the key and the token from your environment:

```toml
[mcp_servers.lighthouse]
url = "https://<tenant id>.atlanticagenticlabs.com/mcp"
bearer_token_env_var = "AAL_KEY"
env_http_headers = { "CF-Access-Client-Id" = "CF_ACCESS_CLIENT_ID", "CF-Access-Client-Secret" = "CF_ACCESS_CLIENT_SECRET" }
```

## Any other MCP client

Use the streamable HTTP transport, the endpoint above, and send three headers with every request:

```text
Authorization: Bearer aalcp-...
CF-Access-Client-Id: <client id>
CF-Access-Client-Secret: <client secret>
```

The server is stateless, so a client never needs to keep a session.

## Signing in, and machine keys

- A machine key is `viewer` or `content_viewer`. Give an assistant a `viewer` key unless it must read your content in place; `content_viewer` lets it use the `knowledge` tool.
- Give each assistant its own key, with a label and the shortest expiry that suits, so you can revoke one without the others. **Settings → API keys** shows each key’s last use.
- No key, and no tool, can approve, pay or change a limit. See [MCP security](/security/mcp/).
- Signing in as yourself with OAuth, or with a device code in a terminal, is \[Coming].

Source: https://docs.atlanticagenticlabs.com/mcp/connect/