Agents and connections
An agent has its own MCP address, sessions, and permission to use saved logins. Make an agent for each app or separate instance of an app that you want to manage independently.
Connect an app
Open Agents, create an agent or select Connect an app, and choose your app. The setup offers instructions for Claude Code, Claude.ai, and another MCP client with headers. Copy the address or configuration shown for that agent. The client setup guides include commands and instructions for Claude Code, Claude.ai, Codex, and other clients.
For an app that supports sign-in, complete the authorization in Rukou. Check the agent and workspace on that page before allowing the connection. Only an agent's owner can connect an app to it, even when an organization owner or admin can see it.
For a client that uses an API key:
- Choose Another MCP client in the setup.
- Make an API key for the agent and copy it while it is displayed. The full key is shown once.
- Replace the example key in the displayed configuration with your key. Store the result in the client's private configuration or secret store.
- Ask the agent to call
rukou_status. Confirm the organization, workspace, and agent match the ones you intended.
The client sends the key as an Authorization: Bearer header to that agent's MCP address. Keep API keys out of prompts, source code, screenshots, and support reports.
Check connections and login access
An agent can have several connections. Its row lists signed-in apps and API keys. A key marked Never used has not made its first authenticated request.
A connection may work for browsing while still showing that logins need access. Select Give access and use your approval method to give it the logins you manage. If a new API key cannot take logins yet, use it once, then return to Agents. Workspace logins may require an admin to give access. See Logins.
Choose page permissions
These permissions are off until you enable them for an agent:
| Permission | What it allows |
|---|---|
| Change browser settings | Use the browser settings tool, including Desktop site |
| Remove page elements | Remove obstructing page elements and scroll locks |
The agent's owner or an organization owner or admin can change these permissions. If your client keeps an old tool list after a change, refresh its MCP connection.
Replace or remove access
Use Replace beside an API key to create a replacement and copy its new value. The flow hands over the logins you manage before removing the old key. Update every client using the old key; shared logins may still need an admin's handover.
Use Remove beside one connection to revoke that connection. A removed signed-in app must sign in again. A client using a removed API key needs a valid key.
Disconnect permanently retires the whole agent: its address and connections stop working and its sessions end. To connect apps again, create a new agent and use its new address.