Claude Code & Other Agents

Command isn’t limited to the built-in chat interface. Any MCP-capable agent can connect with the same tool set that Command Center uses in the browser — this is the operator tier outside the app, primarily for the cegtec team during day-to-day operations, but open to anyone who wants to go deeper.

Connecting

You need exactly two things: the endpoint URL and your workspace key.

https://app.cegtec.net/api/mcp/YOUR_KEY

Find the key under Extensions in the web app. From an already-connected session, get_mcp_key returns it and generate_mcp_key rotates it.

The URL is the password. The key sits in the path; there is no separate header. Anyone holding the full URL has access to the workspace — treat it like an access token: not in a public repository, not in a chat, not in a ticket. Suspect it leaked? generate_mcp_key rotates immediately and the old URL is dead.

The endpoint speaks Streamable HTTP — the current MCP transport, not the older SSE.

Claude Code

claude mcp add --transport http gtm-goat https://app.cegtec.net/api/mcp/YOUR_KEY

Cursor

In ~/.cursor/mcp.json (global) or .cursor/mcp.json (per project):

{
  "mcpServers": {
    "gtm-goat": {
      "url": "https://app.cegtec.net/api/mcp/YOUR_KEY"
    }
  }
}

VS Code

In .vscode/mcp.json:

{
  "servers": {
    "gtm-goat": {
      "type": "http",
      "url": "https://app.cegtec.net/api/mcp/YOUR_KEY"
    }
  }
}

Clients without HTTP transport

Some clients still speak only the local stdio transport. The official mcp-remote bridge exposes the HTTP endpoint locally for them:

{
  "mcpServers": {
    "gtm-goat": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://app.cegtec.net/api/mcp/YOUR_KEY"]
    }
  }
}

The same pattern works for any stdio client — Claude Desktop, Codex CLI and others. When in doubt, check your client’s docs for direct url (HTTP) support; if it has it, the direct route is the better one.

Is it working?

A connected client lists the tools itself. A good first call is explain_system — it returns the system model as structured JSON, and if it answers, the connection stands.

If it isn’t working

Response	What it means
401 Invalid API key	Key wrong, mistyped or rotated. Fetch a fresh one from Extensions.
403 MCP access requires the Growth plan	Not an error but the plan — see below.
429 Too many failed attempts	Too many failed attempts from this IP. The Retry-After header states the wait.

Prerequisite: Growth plan

MCP access is available from Growth upward (Growth and Enterprise). Workspaces predating the self-serve tiers keep their access unchanged. An upgrade takes effect immediately — the endpoint does not cache the rejection.

MCP is an open standard, not a cegtec-proprietary protocol: Claude Code is the reference client, but any other MCP client connects the same way and sees the same tools.

What the agent gets on connect

Every client receives the server instructions on connect — the InitializeResult.instructions part of the MCP protocol — explaining the system model: the nine terms, the object model, the rules every agent must follow. The explain_system tool returns the same orientation again at any time, as structured JSON. Both are standard MCP mechanics, so they work identically for every client, not just Claude Code.

More than the customer tier

Operator access sees the full tool set, not just the curated set in Command Center — including bulk operations across many rows and playbooks at once, and the ability to run entire workflows as a script instead of one chat message at a time. The full tool set is served directly by the workspace’s MCP endpoint: any connected MCP client lists the available tools itself.

Governance still applies

Approvals, workspace isolation, and the credit cap are enforced server-side, not client-side — they apply no matter which agent connects, because they’re bound to the MCP key, not the client software. Even an operator agent proposes; a human approves. See Approvals and Costs.

See also: Command for the customer tier of the same interface.