[rondar](/) [Product](/)[Pricing](/pricing)[Demo](/demo)[Docs](/docs)[Contact](/contact) [Sign in](/access#access-sign-in)[Request an invite](/access) [Product](/)[Pricing](/pricing)[Demo](/demo)[Docs](/docs)[Contact](/contact)[Sign in](/access#access-sign-in) Docs **Help article: Connect an external agent with MCP** Search documentation _Field: `search` (search)_ No matching articles. Start [Your first session](/docs/getting-started)[Connect a repository](/docs/connecting-a-repo)[Connect a coding agent](/docs/connecting-agents) Work [Working with sessions](/docs/sessions)[Plan a change before you build it](/docs/plan-mode)[Preview the running result](/docs/live-previews)[Make your app ready for previews](/docs/preview-ready-app)[From session to pull request](/docs/pull-requests)[Get a second agent to review a pull request](/docs/independent-reviews)[Todos and saved workflows](/docs/todos-and-workflows) Ship [Ship a release](/docs/releases)[Set up GitHub Actions deploy workflows](/docs/github-actions-deploy-workflows) Configure [Agent instructions](/docs/agent-instructions)[Project settings](/docs/project-settings)[Give sessions SSH access to a server](/docs/ssh-servers)[Notifications](/docs/notifications) Integrate [Webhooks](/docs/webhooks)[Connect an external agent with MCP](/docs/mcp-and-api) Reference [When something needs attention](/docs/troubleshooting)[Self-host setup](/docs/self-host-setup)[Frequently asked questions](/docs/faq) Documentation # Connect an external agent with MCP Let Claude Code, Codex or another agent on your computer start Rondar sessions, follow them and read their results. Updated October 29, 2026 1 ## Know what the connection gives Rondar has an MCP server and a REST API. With them, an agent that runs on your computer can use Rondar as its place for long work: - It lists your projects and starts a session in one of them. - It follows the session, reads its messages and sends a reply. - It reads the changed files and the links of the session. - It starts, restarts and stops the preview of a session. - It opens a pull request and starts a release, after you approve. The external agent uses a token to speak to Rondar. The sessions themselves continue to run on the coding-agent accounts that you connected in Rondar. There are two ways to give the agent a token: - **Sign in with your browser (OAuth).** The client opens a Rondar page, and you approve it. You do not copy a token. Use this with a client or a directory that supports OAuth for MCP, such as Claude, ChatGPT, Cursor or Smithery. - **Paste an API token.** You create the token in the settings and put it in the configuration of the client. Use this with a client that has no OAuth, or for a script. 2 ## Connect with a browser sign-in (OAuth) Give the client only the address of the server: ``` https://rondar.dev/api/v1/mcp ``` 1. The client finds the Rondar sign-in itself. It registers, and then it opens a Rondar page in your browser. 2. Sign in to Rondar if necessary. The page shows the name of the app and the address that it returns to. Continue only if you started this connection. 3. Check the workspace. To use a different Rondar account, select **Use another workspace** and sign in with that account. 4. Select the scopes that the app gets. The app asks for the scopes that it needs; you can give fewer. The scopes are the same as the scopes of an API token. 5. Select **Allow access**. The browser returns to the client, and the client is connected. The client gets an access token for one hour and a refresh token. The client gets a new access token with the refresh token, so you do not sign in again each hour. An access token from this sign-in works only on the MCP server, not on the REST API. To end the connection, open **Settings → API tokens** and select **Disconnect** next to the app in **Connected apps**. The app then has no access until you approve it again. If the client does not open a sign-in page, your Rondar does not have OAuth sign-in turned on. Use an API token. For client developers: the server follows the MCP authorization specification. A request without a valid token gets a `401` response with `WWW-Authenticate: Bearer resource_metadata="https://rondar.dev/.well-known/oauth-protected-resource/api/v1/mcp"`. The authorization server metadata is at `https://rondar.dev/.well-known/oauth-authorization-server`. Rondar supports the authorization code flow with PKCE (`S256` only), Dynamic Client Registration at `https://rondar.dev/oauth/register`, refresh tokens with rotation, and revocation at `https://rondar.dev/oauth/revoke`. Send the `resource` parameter with `https://rondar.dev/api/v1/mcp`. 3 ## Create a token Open **Settings → API tokens** and select **Add token**. 1. Give the token a name that tells where you use it. 2. Keep the **External coding agent preset**, or select the scopes yourself. A scope is one permission, for example to read sessions or to make pull requests. 3. Select **Create agent token**. Rondar shows the token one time. It starts with `sk_rondar_`. Copy it now: Rondar stores only a hash of it and cannot show it again. Put the token in an environment variable, not in a file of a repository: ``` export RONDAR_TOKEN="sk_rondar_..." ``` Give each computer or tool its own token. **Revoke** on the same page ends one token and leaves the others. 4 ## Add the server to Claude Code Add this to an `.mcp.json` file that you do not commit: ``` { "mcpServers": { "rondar": { "type": "http", "url": "https://rondar.dev/api/v1/mcp", "headers": { "Authorization": "Bearer ${RONDAR_TOKEN}" } } } } ``` Start Claude Code again and open `/mcp` to see the server. 5 ## Add the server to Codex Add this block to `~/.codex/config.toml`: ``` [mcp_servers.rondar] url = "https://rondar.dev/api/v1/mcp" bearer_token_env_var = "RONDAR_TOKEN" ``` `bearer_token_env_var` keeps the token out of the file. Start Codex again and open `/mcp`. 6 ## Add the server to another client Each client that supports a remote MCP server over HTTP can connect. Give it this address and this header: ``` URL: https://rondar.dev/api/v1/mcp Header: Authorization: Bearer ``` Rondar does not accept a token in the address. 7 ## Make the first call Ask your agent to call the `agent_context` tool. It returns the context that the agent needs for the other tools, and it changes nothing. Then try a real task: ``` Start a Rondar session in the project "bakery-demo": add an allergen filter to the breads page. Tell me when the pull request is open. ``` The tools that the agent sees depend on the scopes of the token. These are the most used: | Purpose | Tools | | --- | --- | | Find the workspace | `agent_context`, `workspace_list_projects`, `workspace_status` | | Start and follow work | `create_session`, `start_session`, `show_session`, `list_session_messages`, `send_session_message` | | Read the result | `get_session_diff`, `get_session_links`, `get_session_artifacts` | | Use the preview | `create_session_preview`, `get_session_preview`, `restart_session_preview`, `stop_session_preview` | | Work with GitHub | `list_project_pull_requests`, `create_pull_request`, `merge_pull_request` | | Ship | `list_release_targets`, `list_project_releases`, `get_release`, `build_release` | | Plan and capture | `list_plans`, `create_plan`, `create_todo` | 8 ## Keep the approval with a person A token lets an agent ask for an action. It is not your approval. - A tool that writes to GitHub, such as `create_pull_request`, runs only when the call has `approved: true`. A careful client asks you before it sends that. - `build_release` has two steps. The first call returns the exact proposal and an approval token that is valid for 10 minutes. The agent shows you the proposal. Only the second call, with your approval and that token, starts the release. Set your client to ask before it calls a tool that writes. Read each proposal before you approve it. 9 ## Use the REST API The same actions are available as a REST API below `https://rondar.dev/api/v1`, with the same token in the `Authorization` header. The description of the API in OpenAPI format is at this address, and it needs no token: ``` https://rondar.dev/api/v1/openapi.json ``` A request that makes something accepts an `Idempotency-Key` header, so that a request that you send again does not make a second session. [Request an invite →](/access) ## On this page [Know what the connection gives](#step-1)[Connect with a browser sign-in (OAuth)](#step-2)[Create a token](#step-3)[Add the server to Claude Code](#step-4)[Add the server to Codex](#step-5)[Add the server to another client](#step-6)[Make the first call](#step-7)[Keep the approval with a person](#step-8)[Use the REST API](#step-9) [rondar](/)© 2026 Rondar [Docs](/docs)[Pricing](/pricing)[Demo](/demo)[Rondar vs Amp](/compare/amp)[Rondar vs T3 Code](/compare/t3-code)[Rondar vs OpenHands](/compare/openhands)[Contact](/contact)[Security](/security)