Connect your agent

Hydrant doesn’t run agents or supply a model. You bring the client; Hydrant gives it one workspace, a name in the history and limits it can’t sweet-talk its way around. About two minutes, most of it spent in your browser.

Before you start

You’re a member of the workspace the agent should work in. Any role will do. The agent never gets more than your role. What you’re approving walks through the consent screen line by line.
An MCP client that speaks Streamable HTTP and OAuth. We test Claude Code, Claude (claude.ai or Desktop) and Codex. Codex needs 0.154.0 or newer; 0.146.0 doesn’t finish the sign-in on the way back.
The address: https://hydrant.dev/api/mcp.
A free slot. Keys and browser connections share one limit per workspace, set by the workspace Owner’s plan: 2 on Free, 20 on Solo Pro, no cap on Team. Every entry that isn’t revoked counts. Expired connections don’t: Hydrant revokes them itself. See Plans and billing.

The same steps live in the app, with the address filled in and copy buttons, under Settings › Agents. With nothing connected yet, Connect your agent is the first thing on the page. Once something is connected, open Connect another agent below Access. Copy setup prompt there gives you the prompt below with your workspace name filled in.

Steps

Let your agent do it

Skip the typing. Paste this into Claude Code, Codex or another agent. It adds Hydrant for its own client, or tells you how when it can’t. Then it starts the sign-in and stops whenever it needs you: to approve in the browser, to restart it, or to run a command that needs a real terminal. It never asks for a key.

Connect yourself to Hydrant, my issue tracker, over MCP. Follow these steps in order and stop whenever you need me.

1. Add the Hydrant MCP server for the client you are running in:
   - Claude Code: claude mcp add --transport http hydrant https://hydrant.dev/api/mcp
   - Codex: codex mcp add hydrant --url https://hydrant.dev/api/mcp
   - Any other client with Streamable HTTP and OAuth: add a server named hydrant at https://hydrant.dev/api/mcp
   If you can't add MCP servers yourself (claude.ai or Claude Desktop, for example), tell me to add a custom connector with that address, then wait.
2. Start the browser sign-in:
   - Claude Code: claude mcp login hydrant
   - Codex: codex mcp login hydrant
   - Any other client: however it authenticates a server.
   If the command needs an interactive terminal, give it to me to run. I'll approve in the browser and choose the workspace you should work in.
3. If the Hydrant tools only appear after a restart or reload, tell me exactly that and wait.
4. Prove it: call get_workspace_identity and tell me the workspace name it returns.
5. Offer to install the Hydrant workflow pack (https://hydrant.dev/help/agents/workflow-pack). Ask me before you write anything to this repository.

Never ask me for an API key, and never put one in a command or a file. The browser sign-in replaces it.

Prefer to run it yourself? The steps for each client follow.

Claude Code

Add Hydrant. The default scope is this project, for you only. Add --scope user for every project you open, or --scope project to write a shared .mcp.json your teammates will see.
Terminal window
```
claude mcp add --transport http hydrant https://hydrant.dev/api/mcp
```
Sign in. Inside Claude Code run /mcp and choose Authenticate, or from a shell:
Terminal window
```
claude mcp login hydrant
```
Over SSH, add --no-browser and open the printed link yourself.
Approve one workspace in the browser tab that opens. Your browser then returns to your own computer. That’s the command line collecting its ticket, not a phishing attempt.

Claude (claude.ai or Desktop)

Open Customize › Connectors › Add custom connector and paste https://hydrant.dev/api/mcp as the URL.
Choose Connect. A Hydrant tab opens: sign in and approve one workspace. Your browser goes back to claude.ai on its own.
Turn the connector on in a chat and ask for something in the workspace.

Custom connectors depend on your Claude plan. If the option isn’t there, that’s the plan, not you.

Codex

Add Hydrant. The CLI, desktop app and IDE extension read the same configuration.
Terminal window
```
codex mcp add hydrant --url https://hydrant.dev/api/mcp
```
Sign in. Codex opens the browser for you:
Terminal window
```
codex mcp login hydrant
```
Approve one workspace in the browser tab that opens.

Want the house rules in the same trip? The Hydrant plugin brings the server and the workflow pack’s base skill, hydrant, together. Install it instead of step 1, then sign in as in step 2:

codex plugin marketplace add Background-Craft/hydrant-skills
codex plugin add hydrant@hydrant

Already added the server yourself? Your entry stays, and the plugin adds only the skill. codex plugin remove hydrant@hydrant takes the plugin out again and leaves your servers alone. The plugin is installed from GitHub. It isn’t in OpenAI’s plugin directory yet.

Another MCP client

Give it https://hydrant.dev/api/mcp. It needs Streamable HTTP and OAuth, with either client ID metadata documents or dynamic registration.
When it opens a browser, sign in and approve one workspace.
Have it read the workspace.

If the client can’t do OAuth at all, use an agent key instead. Or, once agent sign-up is switched on, the agent can register itself and you approve it with a code.

Optional: the workflow pack

npx skills add Background-Craft/hydrant-skills -s hydrant-setup -a claude-code -a codex

The pack’s base skill carries the house rules for writing here: read first, keep request IDs on retries, read back, own the gaps. The rest of the pack carries the workflow: capture, refine, prep, go, review-triage and ship. Connecting doesn’t need it. Behaving does. Drop the -a for the agent you don’t use, then ask your agent to run hydrant-setup. It needs Node.js; npx comes with it. The workflow pack has the rest, including why the flags matter and what to run when npx stops with EOVERRIDE because of overrides in your package.json.

What you should see

Claude Code: claude mcp list says Connected. “Needs authentication” means step 2 again. “Failed” usually means a typo in the address.
Codex: codex mcp list, or /mcp inside Codex, shows hydrant as authenticated.
Everywhere: the connection appears under Settings › Agents › Access. It starts as “authorized, waiting for its first contact” and flips to verified after the agent’s first request. A green dot in your client is your client’s opinion. Verified is the proof.

Try it

Ask in plain words. The agent picks the tools.

“What’s ready for me in Hydrant?”
“File a bug: the export button does nothing on Safari.”
“Read #12 and tell me what’s missing before it’s Ready.”
“What’s blocking the Launch project?”

Reading works with either access level. Filing needs read and write. With read only, those writes fail. Before the first write, prove the connection works.

If it goes sideways

The browser said “Nothing to approve.” The request went stale. Start the sign-in again from your client; reloading the tab won’t revive it.
No browser opened, or you closed it. Run the sign-in step again. Over SSH, use --no-browser.
The browser has the wrong account. On the approval page, use Use another account. Save unfinished work in other Hydrant tabs first. GitHub may keep its own session, so check Signed in as when you return. If the request expires, start again from the client.
Your workspace wasn’t in the list. The account you signed in with isn’t a member there. Ask an Admin for an invitation, then try again. Who can do what.
You approved, but the client still wants authentication. The trip back to the client failed. Revoke that connection under Access and run the sign-in step again.
“Free allows 2 agent connections per workspace…” Every slot is taken. Revoke something you don’t use under Access, then approve again. Expired rows in the Revoked group already gave their slots back.
It connected to the wrong workspace. One connection, one workspace. Revoke it under Access and connect again, picking the right one this time.
To start over: claude mcp remove hydrant or codex mcp remove hydrant, then step 1 again. Other servers in your configuration are not touched.
Installed the Codex plugin? codex mcp remove can’t reach a server the plugin brought. To sign in again, run codex mcp logout hydrant, then codex mcp login hydrant. To take it all out, run codex plugin remove hydrant@hydrant.
Everything else: When an agent gets stuck.