Reference

Most agents should connect with a browser approval. The rest of this page is for clients that cannot open a browser.

Archon exposes a remote Streamable HTTP MCP endpoint. Mint a personal API token in Settings → API tokens, then configure your client with Authorization: Bearer <token>.

Endpoint: https://api.joinarchon.com/api/mcp

• Prefer Bearer API tokens for long-lived agents. Header form: Authorization: Bearer <token>
• Session JWTs also work for short-lived interactive use.
• Token CRUD requires a signed-in session — an API token cannot mint or revoke tokens.
• Use least-privilege scopes. Domain scopes limit which tools an agent can use before role permissions apply.

Cursor, Claude Desktop, VS Code, Codex (remote HTTP)

Paste into MCP settings. Replace <token> with the value from Settings → API tokens.

{
  "mcpServers": {
    "archon": {
      "url": "https://api.joinarchon.com/api/mcp",
      "headers": {
        "Authorization": "Bearer <token>"
      }
    }
  }
}

Stdio companion

When your client prefers stdio, point it at @archon/mcp (or the package from the Archon repo). The companion proxies to /api/mcp.

{
  "mcpServers": {
    "archon": {
      "command": "npx",
      "args": [
        "-y",
        "@archon/mcp"
      ],
      "env": {
        "ARCHON_URL": "https://api.joinarchon.com",
        "ARCHON_TOKEN": "<token>"
      }
    }
  }
}

ChatGPT, Gemini, and generic HTTP MCP

Point the connector at POST https://api.joinarchon.com/api/mcp with Bearer <token> and Accept: application/json, text/event-stream. OAuth connection tools return a browser URL only — never client secrets.

With the right scopes, agents can list plugins, read connection status, drive orchestration and work items, and upsert integration config. Decrypted passwords, OAuth refresh tokens, and similar credentials are not returned in tool results by default.

• Connection status and plugin manifests exclude secret values.
• Writing keys via archon_connections_upsert_api_key requires the connections scope; responses still omit decrypted secrets.
• Explicit reveal tools (for example environment variable reveal) require elevated scopes such as mcp:manage and are audited.
• Account profile tools never expose password hashes or 2FA material.

Unauthenticated clients can read Protected Resource Metadata (RFC 9728):

• GET https://api.joinarchon.com/.well-known/oauth-protected-resource/api/mcp
• GET https://api.joinarchon.com/.well-known/oauth-protected-resource

A 401 on /api/mcp includes a WWW-Authenticate challenge with resource_metadata.