# Atractio Agent MCP Hub — Client Configs ## Choose a connection mode The control console's **Connect this account** page provides two separate copyable prompts: 1. **Direct MCP** — connect selected remote services from the configs in this directory. This exposes each selected service's native tool schemas to the client. 2. **Skills + tool bridge** — install [`atractio-tool`](https://git.barem.atractio.lol/rethinger/atractio-tool), register one local stdio MCP server, and download the live skill from `https://agent.atractio.lol/skills/atractio-hub/SKILL.md`. Only `hub_account`, `hub_skill`, `hub_discover`, and `hub_call` stay in the persistent tool context. Both modes use the same account Bearer token and isolated Mnemosyne bank. Keep the token in a separate user-only secret file; reference it through `AGENT_MCP_TOKEN` for direct configs, or use the adapter's default token file for skills mode. Install the prebuilt tool bundle without a local package build: ```bash curl -fsSL https://git.barem.atractio.lol/rethinger/atractio-tool/raw/branch/main/install.sh | sh ``` On Windows PowerShell: ```powershell irm https://git.barem.atractio.lol/rethinger/atractio-tool/raw/branch/main/install.ps1 | iex ``` The installer runs `atractio-tool setup`, which selects compact or direct mode, the client, and the initial MCP services. ## Setup 1. Open `https://agent.atractio.lol/auth/login` and sign in through Forgejo at `https://git.barem.atractio.lol`. 2. Open `https://agent.atractio.lol/console#setup`. 3. Reveal and copy the current account Bearer token from the same-origin console. 4. Write the token to a separate user-only secret file and reference it as `Authorization: Bearer ` from the MCP client. The auth MCP is available at `https://agent.atractio.lol/mcp/auth/sse` and exposes secret-free login and OAuth setup helpers. OAuth-capable clients use authorization code + PKCE S256. The hub displays a one-time consent page naming the client, redirect target, and every requested scope before Forgejo sign-in. Generic `mcp` scope requests expand to normal tool scopes but never grant `platform:admin`, `git:admin`, or `ci:cancel`. ## Recommended first endpoint ``` https://agent.atractio.lol/mcp/about ``` ## Universal config ``` https://agent.atractio.lol/config/universal-mcp.json ``` ## Client examples * **Hermes Agent**: `/config/hermes.yaml` * **Oh My Pi / MCP Adapter**: `/config/oh-my-pi.mcp.json` * **Codex**: `/config/codex.toml` * **OpenCode**: `/config/opencode.json` * **Cursor-like clients**: `/config/cursor.mcp.json` * **Claude Desktop-like clients**: `/config/claude-desktop.json` ## SSE vs HTTP This hub uses SSE transport. For SSE clients (Oh My Pi, etc.): ``` https://agent.atractio.lol/mcp/{service}/sse ``` All service MCP routes require a valid hub bearer token. The auth discovery metadata and `/auth/login` are public. For clients that need streamable-http or local stdio, use a local bridge/proxy. ## Control plane and asynchronous tools Open `https://agent.atractio.lol/console` after login to manage sessions, operation-bound approvals, account-wide Always approve, audit events, policies, memories, layered service status, incidents, maintenance, jobs and temporary files, CI, credential references, notifications, and tenant-scoped external MCP servers. The additional authenticated services are: * `platform` — policies, privacy-safe audit, jobs, encrypted credential references, and BYO MCP. * `media` — allowlisted Remotion video/still rendering with progress, cancellation, seven-day temporary outputs, per-user quota, deletion, and MCP Tasks. * `ci` — Forgejo Actions runs, dispatch, status, cancellation, task diagnostics, and artifact/run links. * `notify` — HMAC-signed generic webhooks and ntfy destinations for hub events. Writes and destructive calls return `CONFIRMATION_REQUIRED` with an expiring `confirmation_id`. Approve the exact operation in the same-origin console; the console retries only the bound identity, tool, and argument digest. The skills bridge exposes the same schemas on demand through `GET /tool/v1/discover` and invokes them through `POST /tool/v1/call`. `GET /status/v1/summary` publishes component versions, 24-hour/7-day/30-day uptime, p50/p95 latency, error percentage, and four independent layers: gateway, MCP response, dependency, and authenticated test. Incident, maintenance, RSS, email, generic webhook, and ntfy controls are available at `/status` and in the console. Always approve is account-wide and skips ordinary confirmation prompts only. Scope checks, server Deny policies, tenant ownership, isolated-tool deny lists, and network SSRF controls remain enforced. ## Memory isolation Every Forgejo user receives a stable Mnemosyne bank (`rethinger` for the existing administrator, `user_` for other users). The caller cannot select another bank through the REST proxy or an MCP session. ## Security * Public docs do not contain secrets. * Hub tokens are short-lived and refresh tokens rotate. * Upstream Forgejo tokens remain encrypted and server-side. * Do not expose memory, code or git tools without OAuth authentication. * Revoke hub tokens through `POST /oauth/revoke` and rotate secrets after exposure. * BYO MCP and notification destinations are HTTPS-only, DNS-pinned, redirect-blocked, response-limited, and rejected when they resolve to private or reserved networks. * Raw filesystem/shell tools and unsafe browser file/code tools are not exposed. Repository packing accepts approved remote origins, not local gateway paths. * Chromium egress is forced through an HTTPS CONNECT proxy that resolves every destination, rejects private/reserved addresses, pins the validated IP for the connection, and revalidates every redirect connection. ## Playwright service `atractio-playwright` is present in generic hub configs. It is deliberately omitted from `/config/oh-my-pi.mcp.json` and the server's live OMP config because Oh My Pi has its native browser tool. The hub browser has no proxy bypass, blocks service workers, and cannot use plain HTTP or connect to local/private network targets. ## Code service `atractio-code` intentionally starts with no active project. Call Serena's `activate_project` only for an approved path. It runs in the isolated gateway container with no host repositories, Docker socket, or host root credentials. Raw shell/filesystem and Serena-local memory tools are filtered so an MCP client cannot reach the gateway's control-plane or another user's persisted data.