Connect an external agent with MCP

Rondar has an MCP server and a REST API. With them, an agent that runs on your computer can use Rondar as its place for long work:

• It lists your projects and starts a session in one of them.
• It follows the session, reads its messages and sends a reply.
• It reads the changed files and the links of the session.
• It starts, restarts and stops the preview of a session.
• It opens a pull request and starts a release, after you approve.

The external agent uses a token to speak to Rondar. The sessions themselves continue to run on the coding-agent accounts that you connected in Rondar.

There are two ways to give the agent a token:

• Sign in with your browser (OAuth). The client opens a Rondar page, and you approve it. You do not copy a token. Use this with a client or a directory that supports OAuth for MCP, such as Claude, ChatGPT, Cursor or Smithery.
• Paste an API token. You create the token in the settings and put it in the configuration of the client. Use this with a client that has no OAuth, or for a script.

Give the client only the address of the server:

https://rondar.dev/api/v1/mcp

1. The client finds the Rondar sign-in itself. It registers, and then it opens a Rondar page in your browser.
2. Sign in to Rondar if necessary. The page shows the name of the app and the address that it returns to. Continue only if you started this connection.
3. Check the workspace. To use a different Rondar account, select Use another workspace and sign in with that account.
4. Select the scopes that the app gets. The app asks for the scopes that it needs; you can give fewer. The scopes are the same as the scopes of an API token.
5. Select Allow access. The browser returns to the client, and the client is connected.

The client gets an access token for one hour and a refresh token. The client gets a new access token with the refresh token, so you do not sign in again each hour. An access token from this sign-in works only on the MCP server, not on the REST API.

To end the connection, open Settings → API tokens and select Disconnect next to the app in Connected apps. The app then has no access until you approve it again.

If the client does not open a sign-in page, your Rondar does not have OAuth sign-in turned on. Use an API token.

For client developers: the server follows the MCP authorization specification. A request without a valid token gets a 401 response with WWW-Authenticate: Bearer resource_metadata="https://rondar.dev/.well-known/oauth-protected-resource/api/v1/mcp". The authorization server metadata is at https://rondar.dev/.well-known/oauth-authorization-server. Rondar supports the authorization code flow with PKCE (S256 only), Dynamic Client Registration at https://rondar.dev/oauth/register, refresh tokens with rotation, and revocation at https://rondar.dev/oauth/revoke. Send the resource parameter with https://rondar.dev/api/v1/mcp.

Open Settings → API tokens and select Add token.

1. Give the token a name that tells where you use it.
2. Keep the External coding agent preset, or select the scopes yourself. A scope is one permission, for example to read sessions or to make pull requests.
3. Select Create agent token.

Rondar shows the token one time. It starts with sk_rondar_. Copy it now: Rondar stores only a hash of it and cannot show it again.

Put the token in an environment variable, not in a file of a repository:

export RONDAR_TOKEN="sk_rondar_..."

Give each computer or tool its own token. Revoke on the same page ends one token and leaves the others.

Add this to an .mcp.json file that you do not commit:

{
  "mcpServers": {
    "rondar": {
      "type": "http",
      "url": "https://rondar.dev/api/v1/mcp",
      "headers": {
        "Authorization": "Bearer ${RONDAR_TOKEN}"
      }
    }
  }
}

Start Claude Code again and open /mcp to see the server.

Add this block to ~/.codex/config.toml:

[mcp_servers.rondar]
url = "https://rondar.dev/api/v1/mcp"
bearer_token_env_var = "RONDAR_TOKEN"

bearer_token_env_var keeps the token out of the file. Start Codex again and open /mcp.

Each client that supports a remote MCP server over HTTP can connect. Give it this address and this header:

URL:    https://rondar.dev/api/v1/mcp
Header: Authorization: Bearer <your token>

Rondar does not accept a token in the address.

Ask your agent to call the agent_context tool. It returns the context that the agent needs for the other tools, and it changes nothing. Then try a real task:

Start a Rondar session in the project "bakery-demo": add an allergen
filter to the breads page. Tell me when the pull request is open.

The tools that the agent sees depend on the scopes of the token. These are the most used:

A token lets an agent ask for an action. It is not your approval.

• A tool that writes to GitHub, such as create_pull_request, runs only when the call has approved: true. A careful client asks you before it sends that.
• build_release has two steps. The first call returns the exact proposal and an approval token that is valid for 10 minutes. The agent shows you the proposal. Only the second call, with your approval and that token, starts the release.

Set your client to ask before it calls a tool that writes. Read each proposal before you approve it.

The same actions are available as a REST API below https://rondar.dev/api/v1, with the same token in the Authorization header. The description of the API in OpenAPI format is at this address, and it needs no token:

https://rondar.dev/api/v1/openapi.json

A request that makes something accepts an Idempotency-Key header, so that a request that you send again does not make a second session.