# Agents and connections

An agent has its own MCP address, sessions, and permission to use saved logins. Make an agent
for each app or separate instance of an app that you want to manage independently.

## Connect an app

Open **Agents**, create an agent or select **Connect an app**, and choose your app. The setup
offers instructions for Claude Code, Claude.ai, and another MCP client with headers. Copy the
address or configuration shown for that agent. The [client setup guides](connect/README.md)
include commands and instructions for Claude Code, Claude.ai, Codex, and other clients.

For an app that supports sign-in, complete the authorization in Rukou. Check the agent and
workspace on that page before allowing the connection. Only an agent's owner can connect an
app to it, even when an organization owner or admin can see it.

For a client that uses an API key:

1. Choose **Another MCP client** in the setup.
2. Make an API key for the agent and copy it while it is displayed. The full key is shown once.
3. Replace the example key in the displayed configuration with your key. Store the result in
   the client's private configuration or secret store.
4. Ask the agent to call `rukou_status`. Confirm the organization, workspace, and agent match
   the ones you intended.

The client sends the key as an `Authorization: Bearer` header to that agent's MCP address.
Keep API keys out of prompts, source code, screenshots, and support reports.

## Check connections and login access

An agent can have several connections. Its row lists signed-in apps and API keys. A key marked
**Never used** has not made its first authenticated request.

A connection may work for browsing while still showing that logins **need access**. Select
**Give access** and use your approval method to give it the logins you manage. If a new API key
cannot take logins yet, use it once, then return to Agents. Workspace logins may require an
admin to give access. See [Logins](logins.md).

## Choose page permissions

These permissions are off until you enable them for an agent:

| Permission | What it allows |
|---|---|
| **Change browser settings** | Use the browser settings tool, including Desktop site |
| **Remove page elements** | Remove obstructing page elements and scroll locks |

The agent's owner or an organization owner or admin can change these permissions. If your
client keeps an old tool list after a change, refresh its MCP connection.

## Replace or remove access

Use **Replace** beside an API key to create a replacement and copy its new value. The flow
hands over the logins you manage before removing the old key. Update every client using the
old key; shared logins may still need an admin's handover.

Use **Remove** beside one connection to revoke that connection. A removed signed-in app must
sign in again. A client using a removed API key needs a valid key.

**Disconnect** permanently retires the whole agent: its address and connections stop working
and its sessions end. To connect apps again, create a new agent and use its new address.