Connect a client

Connect an MCP client to https://<tenant id>.atlanticagenticlabs.com/mcp with a machine key and your tenant’s Access service token. First issue a viewer key (Settings → API keys) and set:

export AAL_TENANT="<tenant id>"
export AAL_KEY="aalcp-..."
export CF_ACCESS_CLIENT_ID="<client id>"
export CF_ACCESS_CLIENT_SECRET="<client secret>"

See Authentication for the key and the token.

Claude

Claude Code, in one line:

claude mcp add --transport http lighthouse "https://$AAL_TENANT.atlanticagenticlabs.com/mcp" \
  --header "Authorization: Bearer $AAL_KEY" \
  --header "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
  --header "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET"

claude mcp list shows lighthouse as connected. Add --scope user to use it in every project.

Claude’s desktop and web apps add remote servers as connectors that sign in with OAuth. That needs OAuth on the endpoint, which is Coming.

Cursor

In .cursor/mcp.json in your home directory (every project) or in a project’s root (that project), with your own values in place of the placeholders:

{
  "mcpServers": {
    "lighthouse": {
      "url": "https://<tenant id>.atlanticagenticlabs.com/mcp",
      "headers": {
        "Authorization": "Bearer aalcp-...",
        "CF-Access-Client-Id": "<client id>",
        "CF-Access-Client-Secret": "<client secret>"
      }
    }
  }
}

Keep the file out of version control: it holds a key.

Codex

In .codex/config.toml in your home directory, reading the key and the token from your environment:

[mcp_servers.lighthouse]
url = "https://<tenant id>.atlanticagenticlabs.com/mcp"
bearer_token_env_var = "AAL_KEY"
env_http_headers = { "CF-Access-Client-Id" = "CF_ACCESS_CLIENT_ID", "CF-Access-Client-Secret" = "CF_ACCESS_CLIENT_SECRET" }

Any other MCP client

Use the streamable HTTP transport, the endpoint above, and send three headers with every request:

Authorization: Bearer aalcp-...
CF-Access-Client-Id: <client id>
CF-Access-Client-Secret: <client secret>

The server is stateless, so a client never needs to keep a session.

Signing in, and machine keys

• A machine key is viewer or content_viewer. Give an assistant a viewer key unless it must read your content in place; content_viewer lets it use the knowledge tool.
• Give each assistant its own key, with a label and the shortest expiry that suits, so you can revoke one without the others. Settings → API keys shows each key’s last use.
• No key, and no tool, can approve, pay or change a limit. See MCP security.
• Signing in as yourself with OAuth, or with a device code in a terminal, is Coming.