Command line

Local MCP bridge

Some MCP clients can start a local command but cannot connect directly to a remote URL with an authorization header. agentcentral mcp serve is the adapter for those clients: it runs locally, reads your API key from the environment or selected profile, and forwards the client's tool requests to agentcentral.

Do you need the bridge?

Connect directly if	Use the bridge if
The client supports remote MCP URLs and custom headers	The client only supports local stdio MCP servers
You are using Claude custom connectors or a client config with `Authorization` headers	Your config shape expects `command` and `args`

If your client can connect directly, use the configuration examples instead. Direct setup is simpler when the client supports it.

Run the bridge

Set AGENT_CENTRAL_API_KEY or select a profile, then start the bridge:

agentcentral mcp serve
agentcentral mcp serve --profile levain-us
agentcentral mcp serve --read-only
agentcentral mcp serve --domain ads,inventory
agentcentral mcp test

Generate client config

Print a starter config for common clients instead of writing the command block from memory:

agentcentral mcp config claude
agentcentral mcp config cursor
agentcentral mcp config openclaw
agentcentral mcp config hermes

A bridged client launches the CLI as a subprocess. For example:

{
  "mcpServers": {
    "agentcentral": {
      "command": "agentcentral",
      "args": ["mcp", "serve"],
      "env": {
        "AGENT_CENTRAL_API_KEY": "ac_live_..."
      }
    }
  }
}

If you do not want to place the raw key in a config file, export AGENT_CENTRAL_API_KEY in the environment that launches the client and omit the env block.

Bridge behavior

stdout is reserved for MCP traffic

Logs, warnings, and diagnostics go to stderr so the client can read clean MCP messages from stdout.

New tools appear without a CLI update

The bridge asks agentcentral for the current tool list. When your key gains or loses access, the client sees that change.

Local filters are for convenience

--read-only and --domain hide tools locally and reject filtered calls before they leave your machine. The enforced boundary is still the key scope you set in the dashboard. See the security guide.

Startup failures surface in the client

The bridge process stays up long enough for the client to show a useful auth or network error instead of silently disappearing.

Verify

Run the smoke check to confirm the bridge can reach agentcentral:

agentcentral mcp test