Kept Workplace · one paste

Bring your agent into the workplace.

One sentence gives your agent the exact connection steps. You approve the organization and a bounded read grant in the browser. Write access stays a second decision.

Fetch https://kept.do/workplace/agent-setup/prompt.md and follow its instructions to connect Kept Workplace to this agent over MCP.

OAuth 2.1 + PKCERead only firstNo PAT in chat

How it works

Four checkable steps

01Inspect the connection

One remote MCP server at https://mcp.enterprise.kept.do/mcp. The agent shows the command or config change before it runs or writes anything.

02Approve read access

OAuth opens in the browser. The person signs in, chooses the organization, and reviews brief:read, plans:read, docs:read, todos:read, paper:read.

03Verify with a real read

The agent calls a Workplace read tool and reports the protocol result. A tool call, not a narrated claim, proves the connection works.

04Add writes only when needed

Writing is a separate decision. It adds memory:write, plans:write, docs:write, todos:write only after the person asks for it.

What this sees

One organization, five read surfaces

Inside the read grant

The Sealed Brief for the organization approved in OAuth · Plans and their sections · Workplace documents · Todos and their derived status · The Morning Paper

Outside the read grant

Personal Kept notes, tasks, calendar, goals, or habits · Another Workplace organization · Organization memory or the imported corpus without separate read scopes · Email, browser tabs, device files, or cloud drives through this connection · Any Workplace row through a write tool until write scopes are approved

Add writes only when needed

Writing is a separate decision. It adds memory:write, plans:write, docs:write, todos:write only after the person asks for it.

Set it up by hand

The same commands your agent reads

Claude, Claude Code, ChatGPT, Codex, and Cursor all use the shared connection facts from the detailed reference.

Claude on claude.ai

https://mcp.enterprise.kept.do/mcp

Open https://claude.ai/customize/connectors, add a custom connector, and paste the server URL. Leave OAuth client credentials empty. A Workplace owner may need to add the connector for a Team or Enterprise organization.

Claude Code

claude mcp add --transport http kept-workplace https://mcp.enterprise.kept.do/mcp

Then, in the session:

/mcp

Run the add command only after the person approves it. Then use /mcp in the Claude Code session and let the person finish OAuth in the browser.

ChatGPT

https://mcp.enterprise.kept.do/mcp

Enable Developer mode, create an app for the server URL, and let ChatGPT discover OAuth. The registered callback is https://chatgpt.com/connector_platform_oauth_redirect; the person does not paste it into chat.

Codex CLI

codex mcp add --url https://mcp.enterprise.kept.do/mcp kept_workplace

First connection, read only:

codex mcp login --scopes brief:read,plans:read,docs:read,todos:read,paper:read kept_workplace

Optional second step, with writes:

codex mcp login --scopes brief:read,plans:read,docs:read,todos:read,paper:read,memory:write,plans:write,docs:write,todos:write kept_workplace

Add the server, then request the bounded read bundle. Use the full login only as a second step after the person explicitly asks the agent to write Workplace data.

Cursor

"kept-workplace": { "url": "https://mcp.enterprise.kept.do/mcp" }

Add this entry under "mcpServers" in .cursor/mcp.json or the global ~/.cursor/mcp.json, show the diff to the person, then restart Cursor if it asks.