---
title: Connecting an agent
description: Connect Claude Code, Claude Desktop, Cursor or any MCP client to Glowo.
sidebar:
  label: Connecting
---

{/* Source of truth: packages/shared/src/routes.ts — mcp.transport
    (POST /mcp), mcp.grants.*, dashboard mcpConsent/mcpConnections at
    /app/settings/mcp/*. Local server: packages/mcp-server (private:true,
    NOT on npm — build from source). Env: GLOWO_API_TOKEN, GLOWO_API_URL
    (default https://api.glowo.dev), GLOWO_MCP_DEBUG.
    Per-client config shapes verified against each vendor's own docs /
    CLI `--help`; re-check before editing, they drift. */}

There are two transports. Use the hosted one unless you have a specific reason
not to.

## Hosted

The MCP endpoint is:

```http
https://api.glowo.dev/mcp
```

Nothing to install. Your client registers itself, sends you to Glowo to approve
[scopes](/ai-agents/scopes), and receives a token.

Every client below connects to that one URL — only the file it goes in changes.

### Claude Code

```bash
claude mcp add --scope user --transport http glowo https://api.glowo.dev/mcp
```

Or check it into the repository so everyone on the team gets it:

```json title=".mcp.json"
{
  "mcpServers": {
    "glowo": {
      "type": "http",
      "url": "https://api.glowo.dev/mcp"
    }
  }
}
```

The first time the server is used, your browser opens the Glowo consent screen.
Approve the scopes and you are connected.

### Codex CLI

```bash
codex mcp add glowo --url https://api.glowo.dev/mcp
```

`codex mcp add` detects that the endpoint speaks OAuth and starts the browser
flow straight away. If you skip or interrupt it, run the login step on its own —
it is safe to repeat:

```bash
codex mcp login glowo
```

The equivalent config, if you would rather write the file yourself:

```toml title="~/.codex/config.toml"
[mcp_servers.glowo]
url = "https://api.glowo.dev/mcp"
```

`codex mcp list` shows the server with an `Auth` column — it reads
`Not logged in` until the browser flow completes.

:::note
Codex asks for every scope Glowo publishes. That is a ceiling for the
authorization attempt, not a grant — you still pick one of the three presets on
Glowo's consent screen, and it defaults to **Read only**. See
[scopes and consent](/ai-agents/scopes).
:::

### Cursor

```json title=".cursor/mcp.json"
{
  "mcpServers": {
    "glowo": {
      "url": "https://api.glowo.dev/mcp"
    }
  }
}
```

Use `~/.cursor/mcp.json` instead to make it available in every project rather
than just this one.

### VS Code

VS Code uses `servers`, not `mcpServers` — the rest is the same shape.

```json title=".vscode/mcp.json"
{
  "servers": {
    "glowo": {
      "type": "http",
      "url": "https://api.glowo.dev/mcp"
    }
  }
}
```

### Any other MCP client

A client that speaks remote MCP over HTTP **and supports dynamic client
registration** connects with nothing but the URL — no client ID to create, no
secret to paste. Glowo implements RFC 7591 registration and publishes standard
discovery metadata (RFC 8414 authorization-server metadata and RFC 9728
protected-resource metadata), so such a client can find and enrol itself.

Registration is the part to check. A client can support OAuth perfectly well and
still expect you to paste a client ID it cannot obtain here — Glowo issues client
IDs only through dynamic registration, so there is nothing to hand it.

If your client asks for the discovery documents explicitly:

| Document | URL |
| --- | --- |
| Protected resource (RFC 9728) | `https://api.glowo.dev/.well-known/oauth-protected-resource/mcp` |
| Authorization server (RFC 8414) | `https://api.glowo.dev/.well-known/oauth-authorization-server/auth` |

:::caution
The authorization-server document is served at the `/auth`-suffixed path, not at
the bare `/.well-known/oauth-authorization-server`. RFC 8414 §3.1 puts the
issuer's path after the well-known prefix, and Glowo's issuer is
`https://api.glowo.dev/auth`. A client that only probes the bare path gets a 404
— point it at the suffixed URL.
:::

### Managing the connection

Connected clients appear in the dashboard under **Settings → MCP →
Connections**, where you can revoke any of them immediately.

## Local

The stdio server runs on your machine and authenticates with a
[Glowo API key](/account/api-keys) instead of OAuth. Use it when you are running
Glowo yourself, or when you want the client to talk to a local API.

:::caution
`@glowo/mcp-server` is **not published to npm today**, so `npx @glowo/mcp-server`
will not work. Build it from the repository as below. Its own README currently
suggests otherwise — the instructions here are the accurate ones.
:::

1. **Build the server**

    ```bash
    git clone https://github.com/iiAku/glowo.git
    cd glowo
    bun install
    bun run --cwd packages/mcp-server build
    ```

2. **Create an API key**

    In **Settings → API keys**, create a key with only the permissions the agent
    needs. See [API keys](/account/api-keys).

3. **Register it with your client**

    ```bash
    claude mcp add --scope user \
      --env GLOWO_API_TOKEN=gl_... \
      glowo -- node /path/to/glowo/packages/mcp-server/dist/main.js
    ```

### Configuration

| Variable | Purpose | Default |
| --- | --- | --- |
| `GLOWO_API_TOKEN` | Your `gl_` API key | required |
| `GLOWO_API_URL` | API base URL | `https://api.glowo.dev` |
| `GLOWO_MCP_DEBUG` | Verbose logging to stderr | off |

Point `GLOWO_API_URL` at your own instance if you self-host.

The package is MIT licensed and lives at `packages/mcp-server` in the Glowo
repository.

## Which to choose

Use **hosted** if you are on glowo.dev. It needs no build step, grants scopes
through an explicit consent screen, and is revocable per connection.

Use **local** if you self-host Glowo, need the agent to reach an API that is not
publicly routable, or want the client talking to a server you built yourself.

## Checking it works

Ask the agent something read-only first:

> Which of my monitors are currently down?

If it answers, the connection and its scopes are good. If it reports a
permission error, widen the [scopes](/ai-agents/scopes) — or, on the local
transport, the permissions on the API key.