Kept Workplace · one paste

Bring your agent into the workplace.

One sentence gives your agent the exact connection steps. You approve the organization and a bounded read grant in the browser. Write access stays a second decision.

Fetch https://kept.do/workplace/agent-setup/prompt.md and follow its instructions to connect Kept Workplace to this agent over MCP.

OAuth 2.1 + PKCERead only firstNo PAT in chat

How it works

Four checkable steps

01Inspect the connection

One remote MCP server at https://mcp.enterprise.kept.do/mcp. Use native OAuth with no static Authorization header.

02Choose access

OAuth opens in the browser. The person signs in, chooses the organization, and reviews the requested permissions.

03Verify with a real read

The agent calls a Workplace read tool and reports the protocol result. A tool call, not a narrated claim, proves the connection works.

04Resume shared work

When task management is authorized, read the shared queue, claim the work, renew the lease, and finish with evidence.

What this sees

One organization, five read surfaces

Inside the read grant

The Sealed Brief for the organization approved in OAuth · Plans and their sections · Workplace documents · Todos and their derived status · The Morning Paper

Outside the read grant

Personal Kept notes, tasks, calendar, goals, or habits · Another Workplace organization · Organization memory or the imported corpus without separate read scopes · Email, browser tabs, device files, or cloud drives through this connection · Any Workplace row through a write tool until write scopes are approved

Resume shared work

When task management is authorized, read the shared queue, claim the work, renew the lease, and finish with evidence.

Set it up by hand

The same commands your agent reads

Claude, Claude Code, ChatGPT, Codex, and Cursor all use the shared connection facts from the detailed reference.

Claude on claude.ai

https://mcp.enterprise.kept.do/mcp

Open https://claude.ai/customize/connectors, add a custom connector, and paste the server URL. Leave OAuth client credentials empty. A Workplace owner may need to add the connector for a Team or Enterprise organization.

Claude Code

claude mcp add --transport http kept-workplace https://mcp.enterprise.kept.do/mcp

Then, in the session:

/mcp

Add the server with OAuth and no Authorization header. Then use /mcp and let the person finish sign-in and consent in the browser.

ChatGPT

https://mcp.enterprise.kept.do/mcp

Enable Developer mode, create an app for the server URL, and let ChatGPT discover OAuth. The registered callback is https://chatgpt.com/connector_platform_oauth_redirect; the person does not paste it into chat.

Codex CLI

codex mcp add --url https://mcp.enterprise.kept.do/mcp kept_workplace

For reading Workplace:

codex mcp login --scopes brief:read,plans:read,docs:read,todos:read,paper:read,spaces:read,projects:read,members:read,comments:read,files:read,inbox:read,offline_access kept_workplace

For managing Workplace tasks:

codex mcp login --scopes brief:read,plans:read,docs:read,todos:read,paper:read,spaces:read,projects:read,members:read,comments:read,files:read,inbox:read,memory:read,memory:write,plans:write,docs:write,todos:write,corpus:read,spaces:write,projects:write,comments:write,files:write,inbox:write,offline_access kept_workplace

Codex add may begin OAuth immediately with all advertised scopes. For bounded read access, merge a URL-only config entry first, then run the read login. For requested task management, use the full grant. Both include offline_access for refresh.

Cursor

"kept-workplace": { "url": "https://mcp.enterprise.kept.do/mcp" }

Add this entry under "mcpServers" in .cursor/mcp.json or the global ~/.cursor/mcp.json, show the diff to the person, then restart Cursor if it asks.