# Quickstart: connect your coding agent

> Add Rytiv to Claude Code with one command. Your agent can then deploy apps, create databases and work in computers on Rytiv.

Rytiv runs an MCP server at `https://api.rytiv.app/v1/mcp`. Connect your agent to it once, and the agent sees Rytiv's [tools](https://docs.rytiv.com/reference/mcp-tools.md): it can list and deploy apps, read their logs, set secrets, create Postgres databases and branches, run read-only SQL, and create, use and snapshot computers.

## Before you start

You need a Rytiv account and an API key. Accounts come from the waitlist on rytiv.com, and every admitted account starts with 100 EUR of [credit](https://docs.rytiv.com/billing.md). A key acts for your whole organization unless you narrow it, so treat it like a password.

## 1. Create an API key

Create a key in the Rytiv console (Team, then Tokens), or with the CLI if you have it installed. The value is shown exactly once.

**CLI**

```bash
ry tokens create claude-code --agent sandbox
```

**curl**

```bash
curl -X POST https://api.rytiv.app/v1/tokens \
  -H "Authorization: Bearer $RYTIV_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "claude-code", "agent": {"class": "sandbox"}}'
```

`--agent sandbox` makes it an [agent key](https://docs.rytiv.com/authentication.md#agent-keys): it can do what a key of your organization can do, except create, reveal or revoke credentials. Add `--app <name>` to limit it to the apps you name. Creating a key over the API needs a key already, so your first one comes from the console or from `ry login`. See [Authentication](https://docs.rytiv.com/authentication.md).

## 2. Add Rytiv to Claude Code

Run this in a terminal, with your key in place of `<your key>`:

```bash
claude mcp add --transport http rytiv https://api.rytiv.app/v1/mcp --header "Authorization: Bearer <your key>"
```

This adds a server named `rytiv` in the default scope, for you in the current project. Add `--scope user` to use it in all your projects.

> **Keep the key out of shared files:** To share the setup with your team through a project's `.mcp.json`, reference an environment variable instead of the key. Claude Code expands `${VAR}` in the `url` and `headers` of an HTTP server:
>
> ```json
> {
>   "mcpServers": {
>     "rytiv": {
>       "type": "http",
>       "url": "https://api.rytiv.app/v1/mcp",
>       "headers": { "Authorization": "Bearer ${RYTIV_TOKEN}" }
>     }
>   }
> }
> ```
>
> Each person then sets `RYTIV_TOKEN` in their own environment.

## 3. Check the connection

```bash
claude mcp list
```

The list shows `rytiv` with its status. Inside Claude Code, `/mcp` shows the same.

## 4. Ask your agent to build

Start Claude Code in your project and ask in plain words. A few first prompts:

- "List my apps on Rytiv."
- "Deploy `nginx:alpine` on Rytiv as an app called `hello` (it listens on port 80) and give me its URL."
- "Show me the logs of `hello`."
- "Create a Postgres database called `appdb` on Rytiv, branch it, and try the migration on the branch."
- "Create a computer on Rytiv, clone my repository into it and run the tests there."

The agent picks the tools itself. Every tool carries annotations that your client can use to decide which calls to confirm with you: `readOnlyHint` on all of them, and `destructiveHint` and `idempotentHint` on the tools that write. `execute_sql` only reads unless you name a branch, so a write goes to a copy and never to the database itself.

## Let read-only tools run without asking

In Claude Code, the tools of a server named `rytiv` are called `mcp__rytiv__<tool>`. To stop Claude Code from asking before the tools that only read, allow them in your project's `.claude/settings.json`:

```json
{
  "permissions": {
    "allow": ["mcp__rytiv__search_docs", "mcp__rytiv__list_apps", "mcp__rytiv__get_logs"]
  }
}
```

Leave the tools that change something on asking until you trust the setup.

## Other agents and clients

The Codex plugin and the Cursor install link follow; both connect to the same endpoint with the same key. Until then, any MCP client that speaks Streamable HTTP with a bearer header can use the address above. For Codex that is `codex mcp add rytiv --url https://api.rytiv.app/v1/mcp --bearer-token-env-var RYTIV_TOKEN`, with `RYTIV_TOKEN` set in the environment Codex starts from.

**Hosted connectors** that sign in with OAuth, for example a custom connector in claude.ai, need nothing but the address `https://api.rytiv.app/v1/mcp`: they register themselves, you approve the connection once in the Rytiv console, and no key is pasted anywhere. See [Connect without a key](https://docs.rytiv.com/authentication.md#connect-without-a-key).

Passkey confirmations for irreversible steps are not yet available, see [Confirmations](https://docs.rytiv.com/concepts/confirmations.md).

## What the key can do

A key without an agent class acts as your organization: everything the tools allow, in every app of your organization, and nothing outside it. An agent key is held to its class by the platform, not by the prompt: `sandbox` and `twin` may do what your organization's keys do, except create, reveal or revoke credentials; `production` may only read. With `--app`, the key reaches the named apps and nothing else. The details and the error codes are under [Agent keys](https://docs.rytiv.com/authentication.md#agent-keys).

## Next steps

- [MCP tools](https://docs.rytiv.com/reference/mcp-tools.md): every tool with its parameters.
- [How Rytiv works](https://docs.rytiv.com/concepts/how-it-works.md): what your agent is creating.
- [Computers](https://docs.rytiv.com/computers.md): a machine of its own for your agent, with Codex, OpenCode, Node.js, git and gh preinstalled, and how to run Claude Code inside it.
- [Agents and tokens](https://docs.rytiv.com/guides/agents-and-tokens.md): a key per agent, narrowed by class, apps and scopes, and the audit of what it did.
- [CLI reference](https://docs.rytiv.com/reference/cli.md) and [API reference](https://docs.rytiv.com/reference/api.md): the same platform from your terminal and your code.