From 5cee424a9957dc0b66d1bddc339e365067feebcc Mon Sep 17 00:00:00 2001 From: Agent Date: Wed, 14 Oct 2026 01:33:56 +0000 Subject: [PATCH 1/2] feat(plugins): Codex gets the plugin surface /mcp/plugin/chatgpt; Claude Code keeps the full /mcp MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Codex manifest's mcpServers now points at its own file, .mcp.codex.json, whose one server is https://api.corespeed.io/mcp/plugin/chatgpt: the fixed surface corespeed-haas#1003 serves — shared memory, the caller's identity, connector discovery (connectors_search / connect / wait) and the approval wait — a small list no organization's connector count can push past Codex's 2,048-tool catalog limit, and the shape the OpenAI Plugins Directory reviews. A connected app's tools are called through the bundled cs-cli skill; the skill's intro (both copies) says so. Claude Code keeps the full /mcp through .mcp.json, unchanged. Manifest texts describe the Codex plugin as memory, connector discovery and the CLI; both manifests go to 0.3.0. CI gains a guard pinning the Codex server file and its URL; the README says which client gets which server. Verified in Codex 0.151.0 from this tree: codex plugin add corespeed@corespeed installs 0.3.0 and codex mcp list shows corespeed at https://api.corespeed.io/mcp/plugin/chatgpt. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/check.yml | 13 ++++++++++++- README.md | 15 +++++++++++---- plugins/corespeed-cli/skills/cs-cli/SKILL.md | 11 +++++++---- plugins/corespeed/.claude-plugin/plugin.json | 2 +- plugins/corespeed/.codex-plugin/plugin.json | 16 ++++++++-------- plugins/corespeed/.mcp.codex.json | 8 ++++++++ plugins/corespeed/skills/cs-cli/SKILL.md | 11 +++++++---- 7 files changed, 54 insertions(+), 22 deletions(-) create mode 100644 plugins/corespeed/.mcp.codex.json diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index d2a4386..68d2164 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -19,7 +19,7 @@ jobs: run: | for f in .agents/plugins/marketplace.json .claude-plugin/marketplace.json \ plugins/corespeed/.codex-plugin/plugin.json plugins/corespeed/.claude-plugin/plugin.json \ - plugins/corespeed/.mcp.json plugins/corespeed-cli/.codex-plugin/plugin.json; do + plugins/corespeed/.mcp.json plugins/corespeed/.mcp.codex.json plugins/corespeed-cli/.codex-plugin/plugin.json; do jq empty "$f" || { echo "::error file=$f::invalid JSON"; exit 1; } done - name: The MCP server signs in with OAuth @@ -30,6 +30,17 @@ jobs: jq -e '.mcpServers | length == 1 and (.corespeed | keys == ["type", "url"]) and .corespeed.url == "https://api.corespeed.io/mcp"' \ plugins/corespeed/.mcp.json > /dev/null \ || { echo "::error file=plugins/corespeed/.mcp.json::expected exactly {type, url} pointing at https://api.corespeed.io/mcp"; exit 1; } + - name: Codex gets the plugin surface, Claude Code the full server + # The Codex manifest points at its own mcpServers file: the fixed + # plugin surface /mcp/plugin/chatgpt (memory, connector discovery), + # which no organization's connector count can push past a client's + # catalog limit. Claude Code keeps the full /mcp through .mcp.json. + run: | + [ "$(jq -r .mcpServers plugins/corespeed/.codex-plugin/plugin.json)" = "./.mcp.codex.json" ] \ + || { echo "::error file=plugins/corespeed/.codex-plugin/plugin.json::mcpServers must point at ./.mcp.codex.json"; exit 1; } + jq -e '.mcpServers | length == 1 and (.corespeed | keys == ["type", "url"]) and .corespeed.url == "https://api.corespeed.io/mcp/plugin/chatgpt"' \ + plugins/corespeed/.mcp.codex.json > /dev/null \ + || { echo "::error file=plugins/corespeed/.mcp.codex.json::expected exactly {type, url} pointing at https://api.corespeed.io/mcp/plugin/chatgpt"; exit 1; } - name: The CLI plugin is skills-only and bundles the same cs-cli skill # corespeed-cli registers no MCP server: that is the point of it (a # client loads no tool list). Its cs-cli skill is a copy of the MCP diff --git a/README.md b/README.md index 9e3fdf5..402d5c4 100644 --- a/README.md +++ b/README.md @@ -34,6 +34,13 @@ select **Authenticate** (or open **Settings → MCP servers → CoreSpeed**) and finish the sign-in in the browser. In the ChatGPT desktop app the plugin appears under the **CoreSpeed** marketplace once it has been added. +In Codex the plugin's server is `https://api.corespeed.io/mcp/plugin/chatgpt`: +a fixed, small tool list — shared memory and connector discovery — that no +organization's connector count can push past Codex's catalog limit. The agent +finds an app with `manage__connectors_search`, hands you a link to connect it, +and calls a connected app's tools through the bundled `cs-cli` skill +(`cs mcp search`, `cs mcp get`, `cs mcp call`). + ## Codex, CLI only ```bash @@ -63,7 +70,7 @@ organizations, connects apps, and calls tools from a terminal. See the | Plugin | Part | What it does | | --- | --- | --- | -| `corespeed` | MCP server | `https://api.corespeed.io/mcp` with browser sign-in (OAuth 2.1 + PKCE). You never paste an API key. | +| `corespeed` | MCP server | Browser sign-in (OAuth 2.1 + PKCE), never a pasted key. Claude Code: the full `https://api.corespeed.io/mcp`. Codex: the plugin surface `https://api.corespeed.io/mcp/plugin/chatgpt` (memory, connector discovery). | | `corespeed` | `cs-cli` skill | Using the `cs` CLI: sign-in, finding and calling tools from a shell, memory, API keys, organizations, connectors, remote MCP servers, credit. | | `corespeed` | `cs-api` skill | Calling CoreSpeed over HTTP from code and CI: credentials, `tools/list` and `tools/call`, error codes, credits. | | `corespeed-cli` | `cs-cli` skill | The same skill, and nothing else: no MCP server is registered. | @@ -72,9 +79,9 @@ If you added CoreSpeed to your client by hand earlier (`claude mcp add` or `codex mcp add`), remove that entry before installing the plugin, so every tool is registered once. -Sign-in happens at `login.corespeed.io`, and the plugins' only server is -`https://api.corespeed.io/mcp`. Anything else claiming to be CoreSpeed is not -this plugin. +Sign-in happens at `login.corespeed.io`, and the plugins' only servers are +`https://api.corespeed.io/mcp` and `https://api.corespeed.io/mcp/plugin/chatgpt`. +Anything else claiming to be CoreSpeed is not this plugin. ## Other clients diff --git a/plugins/corespeed-cli/skills/cs-cli/SKILL.md b/plugins/corespeed-cli/skills/cs-cli/SKILL.md index 99ae637..85e6e78 100644 --- a/plugins/corespeed-cli/skills/cs-cli/SKILL.md +++ b/plugins/corespeed-cli/skills/cs-cli/SKILL.md @@ -9,10 +9,13 @@ description: Use when a task needs the CoreSpeed CLI (cs, npm package @corespeed under a member session stored on this machine. It needs Node.js 20 or Bun and has no runtime dependencies. -If your client already has the CoreSpeed MCP server -(`https://api.corespeed.io/mcp`), call its tools directly. Use `cs` when it -does not: a plugin without an MCP server, a client that cannot load a large -tool list, a human at a terminal, or a CI job that needs an API key. +If your client has the full CoreSpeed MCP server +(`https://api.corespeed.io/mcp`), call its tools directly. The Codex plugin's +server (`https://api.corespeed.io/mcp/plugin/chatgpt`) carries memory and +connector discovery only, so there a connected app's tools are called with +`cs`. Use `cs` as well when there is no MCP server, when a client cannot load a +large tool list, when a human is at a terminal, or when a CI job needs an API +key. The canonical reference is https://corespeed.io/docs/cli. When this skill and the docs disagree, the docs win. diff --git a/plugins/corespeed/.claude-plugin/plugin.json b/plugins/corespeed/.claude-plugin/plugin.json index a72f926..79f93cf 100644 --- a/plugins/corespeed/.claude-plugin/plugin.json +++ b/plugins/corespeed/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "corespeed", - "version": "0.2.1", + "version": "0.3.0", "description": "Connect Claude Code to CoreSpeed: your connected apps, shared memory, media, web and social tools through one MCP server, plus skills for the cs CLI and the HTTP API.", "author": { "name": "CoreSpeed", diff --git a/plugins/corespeed/.codex-plugin/plugin.json b/plugins/corespeed/.codex-plugin/plugin.json index 187e148..ebe4c34 100644 --- a/plugins/corespeed/.codex-plugin/plugin.json +++ b/plugins/corespeed/.codex-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "corespeed", - "version": "0.2.1", - "description": "Connect Codex to CoreSpeed: your connected apps, shared memory, media, web and social tools through one MCP server, plus skills for the cs CLI and the HTTP API.", + "version": "0.3.0", + "description": "Connect Codex to CoreSpeed: long-term memory shared across your agents and connector discovery through one MCP server, the tools of your connected apps through the cs CLI, plus skills for the CLI and the HTTP API.", "author": { "name": "CoreSpeed", "email": "contact@corespeed.io", @@ -19,11 +19,11 @@ "agents" ], "skills": "./skills/", - "mcpServers": "./.mcp.json", + "mcpServers": "./.mcp.codex.json", "interface": { "displayName": "CoreSpeed", - "shortDescription": "Connected apps, memory and tools for agents", - "longDescription": "Connect Codex to CoreSpeed's MCP server with a browser sign-in: the tools of every app your organization has connected, long-term memory shared across agents, media generation and understanding, live web search and public social data, all on one wallet with spend caps and an audit trail. Bundled skills cover the cs CLI and calling CoreSpeed over HTTP from code and CI.", + "shortDescription": "Shared memory, connector discovery, and your apps' tools through the cs CLI", + "longDescription": "Connect Codex to CoreSpeed with a browser sign-in. The plugin's MCP server carries long-term memory shared across your organization's agents and connector discovery: the agent finds an app your organization uses, sees whether it is connected, and hands you a one-click link to connect it. The tools of connected apps are called through the bundled cs CLI skill (cs mcp search, cs mcp get, cs mcp call), so Codex loads a small, fixed tool list whatever your organization has connected. Every call is metered on one wallet with spend caps and an audit trail, and a human can be asked to approve a write first.", "developerName": "CoreSpeed", "category": "Developer Tools", "capabilities": [ @@ -34,9 +34,9 @@ "websiteURL": "https://corespeed.io", "privacyPolicyURL": "https://corespeed.io/privacy", "defaultPrompt": [ - "Search my CoreSpeed memory for context relevant to this task.", - "Show my connected CoreSpeed tools and explain what I can do with them.", - "Set up this project's CI to call CoreSpeed with an API key." + "Search my CoreSpeed memory for context on this repository before we start.", + "Find out whether my organization has Notion connected on CoreSpeed, and give me the link if not.", + "Use the cs CLI to find the CoreSpeed tool for this task, show its schema, then call it." ], "brandColor": "#C2410C", "composerIcon": "./assets/icon.svg", diff --git a/plugins/corespeed/.mcp.codex.json b/plugins/corespeed/.mcp.codex.json new file mode 100644 index 0000000..5ffbf5c --- /dev/null +++ b/plugins/corespeed/.mcp.codex.json @@ -0,0 +1,8 @@ +{ + "mcpServers": { + "corespeed": { + "type": "http", + "url": "https://api.corespeed.io/mcp/plugin/chatgpt" + } + } +} diff --git a/plugins/corespeed/skills/cs-cli/SKILL.md b/plugins/corespeed/skills/cs-cli/SKILL.md index 99ae637..85e6e78 100644 --- a/plugins/corespeed/skills/cs-cli/SKILL.md +++ b/plugins/corespeed/skills/cs-cli/SKILL.md @@ -9,10 +9,13 @@ description: Use when a task needs the CoreSpeed CLI (cs, npm package @corespeed under a member session stored on this machine. It needs Node.js 20 or Bun and has no runtime dependencies. -If your client already has the CoreSpeed MCP server -(`https://api.corespeed.io/mcp`), call its tools directly. Use `cs` when it -does not: a plugin without an MCP server, a client that cannot load a large -tool list, a human at a terminal, or a CI job that needs an API key. +If your client has the full CoreSpeed MCP server +(`https://api.corespeed.io/mcp`), call its tools directly. The Codex plugin's +server (`https://api.corespeed.io/mcp/plugin/chatgpt`) carries memory and +connector discovery only, so there a connected app's tools are called with +`cs`. Use `cs` as well when there is no MCP server, when a client cannot load a +large tool list, when a human is at a terminal, or when a CI job needs an API +key. The canonical reference is https://corespeed.io/docs/cli. When this skill and the docs disagree, the docs win. From a98aeb6897304ca4be06b9003c326b811579e1cc Mon Sep 17 00:00:00 2001 From: Agent Date: Wed, 14 Oct 2026 01:40:27 +0000 Subject: [PATCH 2/2] fix(plugins): the root .mcp.json is the plugin surface; Claude Code's manifest names the full server MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The OpenAI Plugins Directory accepts mcpServers only as ./.mcp.json at the plugin root (plugin_mcp_path_unsupported otherwise), so the surface Codex and the Directory need — https://api.corespeed.io/mcp/plugin/chatgpt — moves into the root file, and .mcp.codex.json goes. Claude Code's manifest declares "./.mcp.claude.json" with the full /mcp: Claude Code loads the root .mcp.json first, then the declared file, and a server declared later replaces an earlier one of the same name, so Claude Code keeps the full server. CI guards pin all four facts. cs-api says both URLs take the same credentials and that the Codex plugin's server is the surface. Verified: `claude plugin validate` passes; from this tree as a local marketplace, Codex 0.151.0 lists corespeed at /mcp/plugin/chatgpt and Claude Code 2.1.251 lists plugin:corespeed:corespeed at /mcp. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/check.yml | 41 +++++++++++-------- README.md | 9 ++-- plugins/corespeed/.claude-plugin/plugin.json | 10 ++++- plugins/corespeed/.codex-plugin/plugin.json | 2 +- .../{.mcp.codex.json => .mcp.claude.json} | 2 +- plugins/corespeed/.mcp.json | 2 +- plugins/corespeed/skills/cs-api/SKILL.md | 6 ++- 7 files changed, 46 insertions(+), 26 deletions(-) rename plugins/corespeed/{.mcp.codex.json => .mcp.claude.json} (55%) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 68d2164..9a289af 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -19,28 +19,35 @@ jobs: run: | for f in .agents/plugins/marketplace.json .claude-plugin/marketplace.json \ plugins/corespeed/.codex-plugin/plugin.json plugins/corespeed/.claude-plugin/plugin.json \ - plugins/corespeed/.mcp.json plugins/corespeed/.mcp.codex.json plugins/corespeed-cli/.codex-plugin/plugin.json; do + plugins/corespeed/.mcp.json plugins/corespeed/.mcp.claude.json plugins/corespeed-cli/.codex-plugin/plugin.json; do jq empty "$f" || { echo "::error file=$f::invalid JSON"; exit 1; } done - - name: The MCP server signs in with OAuth + - name: The MCP servers sign in with OAuth # The plugin must never ask for an API key: the client discovers the - # authorization server from the /mcp challenge (RFC 9728), so the entry - # carries only the URL — no headers, no token env var, no oauth_resource. + # authorization server from the server's challenge (RFC 9728), so each + # entry carries only the URL — no headers, no token env var, no oauth_resource. run: | - jq -e '.mcpServers | length == 1 and (.corespeed | keys == ["type", "url"]) and .corespeed.url == "https://api.corespeed.io/mcp"' \ - plugins/corespeed/.mcp.json > /dev/null \ - || { echo "::error file=plugins/corespeed/.mcp.json::expected exactly {type, url} pointing at https://api.corespeed.io/mcp"; exit 1; } - - name: Codex gets the plugin surface, Claude Code the full server - # The Codex manifest points at its own mcpServers file: the fixed - # plugin surface /mcp/plugin/chatgpt (memory, connector discovery), - # which no organization's connector count can push past a client's - # catalog limit. Claude Code keeps the full /mcp through .mcp.json. + jq -e '.mcpServers | length == 1 and (.corespeed | keys == ["type", "url"])' plugins/corespeed/.mcp.json > /dev/null \ + || { echo "::error file=plugins/corespeed/.mcp.json::expected exactly {type, url}"; exit 1; } + jq -e '.mcpServers | length == 1 and (.corespeed | keys == ["type", "url"])' plugins/corespeed/.mcp.claude.json > /dev/null \ + || { echo "::error file=plugins/corespeed/.mcp.claude.json::expected exactly {type, url}"; exit 1; } + - name: Codex and the Directory get the plugin surface; Claude Code the full server + # The OpenAI Plugins Directory accepts mcpServers only as the root + # ./.mcp.json, so that file is the fixed plugin surface + # /mcp/plugin/chatgpt (memory, connector discovery), which no + # organization's connector count can push past Codex's catalog limit. + # Claude Code loads .mcp.json first and then the file its manifest + # names; the later `corespeed` entry replaces the earlier one, so it + # gets the full /mcp from .mcp.claude.json. run: | - [ "$(jq -r .mcpServers plugins/corespeed/.codex-plugin/plugin.json)" = "./.mcp.codex.json" ] \ - || { echo "::error file=plugins/corespeed/.codex-plugin/plugin.json::mcpServers must point at ./.mcp.codex.json"; exit 1; } - jq -e '.mcpServers | length == 1 and (.corespeed | keys == ["type", "url"]) and .corespeed.url == "https://api.corespeed.io/mcp/plugin/chatgpt"' \ - plugins/corespeed/.mcp.codex.json > /dev/null \ - || { echo "::error file=plugins/corespeed/.mcp.codex.json::expected exactly {type, url} pointing at https://api.corespeed.io/mcp/plugin/chatgpt"; exit 1; } + [ "$(jq -r .mcpServers plugins/corespeed/.codex-plugin/plugin.json)" = "./.mcp.json" ] \ + || { echo "::error file=plugins/corespeed/.codex-plugin/plugin.json::mcpServers must be ./.mcp.json (the Directory accepts no other path)"; exit 1; } + [ "$(jq -r .mcpServers.corespeed.url plugins/corespeed/.mcp.json)" = "https://api.corespeed.io/mcp/plugin/chatgpt" ] \ + || { echo "::error file=plugins/corespeed/.mcp.json::must point at https://api.corespeed.io/mcp/plugin/chatgpt"; exit 1; } + [ "$(jq -r .mcpServers plugins/corespeed/.claude-plugin/plugin.json)" = "./.mcp.claude.json" ] \ + || { echo "::error file=plugins/corespeed/.claude-plugin/plugin.json::mcpServers must be ./.mcp.claude.json"; exit 1; } + [ "$(jq -r .mcpServers.corespeed.url plugins/corespeed/.mcp.claude.json)" = "https://api.corespeed.io/mcp" ] \ + || { echo "::error file=plugins/corespeed/.mcp.claude.json::must point at https://api.corespeed.io/mcp"; exit 1; } - name: The CLI plugin is skills-only and bundles the same cs-cli skill # corespeed-cli registers no MCP server: that is the point of it (a # client loads no tool list). Its cs-cli skill is a copy of the MCP diff --git a/README.md b/README.md index 402d5c4..12a75a4 100644 --- a/README.md +++ b/README.md @@ -34,9 +34,12 @@ select **Authenticate** (or open **Settings → MCP servers → CoreSpeed**) and finish the sign-in in the browser. In the ChatGPT desktop app the plugin appears under the **CoreSpeed** marketplace once it has been added. -In Codex the plugin's server is `https://api.corespeed.io/mcp/plugin/chatgpt`: -a fixed, small tool list — shared memory and connector discovery — that no -organization's connector count can push past Codex's catalog limit. The agent +In Codex the plugin's server (the root `.mcp.json`, the one file the OpenAI +Plugins Directory accepts) is `https://api.corespeed.io/mcp/plugin/chatgpt`: a +fixed, small tool list — shared memory and connector discovery — that no +organization's connector count can push past Codex's catalog limit. Claude Code +gets the full `https://api.corespeed.io/mcp` from `.mcp.claude.json`, which its +manifest declares and which replaces the root entry by name. The agent finds an app with `manage__connectors_search`, hands you a link to connect it, and calls a connected app's tools through the bundled `cs-cli` skill (`cs mcp search`, `cs mcp get`, `cs mcp call`). diff --git a/plugins/corespeed/.claude-plugin/plugin.json b/plugins/corespeed/.claude-plugin/plugin.json index 79f93cf..0ab694c 100644 --- a/plugins/corespeed/.claude-plugin/plugin.json +++ b/plugins/corespeed/.claude-plugin/plugin.json @@ -10,5 +10,13 @@ "homepage": "https://corespeed.io/docs", "repository": "https://github.com/corespeed-io/cs", "license": "Apache-2.0", - "keywords": ["corespeed", "mcp", "memory", "connectors", "cli", "agents"] + "keywords": [ + "corespeed", + "mcp", + "memory", + "connectors", + "cli", + "agents" + ], + "mcpServers": "./.mcp.claude.json" } diff --git a/plugins/corespeed/.codex-plugin/plugin.json b/plugins/corespeed/.codex-plugin/plugin.json index ebe4c34..0ee8ed5 100644 --- a/plugins/corespeed/.codex-plugin/plugin.json +++ b/plugins/corespeed/.codex-plugin/plugin.json @@ -19,7 +19,7 @@ "agents" ], "skills": "./skills/", - "mcpServers": "./.mcp.codex.json", + "mcpServers": "./.mcp.json", "interface": { "displayName": "CoreSpeed", "shortDescription": "Shared memory, connector discovery, and your apps' tools through the cs CLI", diff --git a/plugins/corespeed/.mcp.codex.json b/plugins/corespeed/.mcp.claude.json similarity index 55% rename from plugins/corespeed/.mcp.codex.json rename to plugins/corespeed/.mcp.claude.json index 5ffbf5c..6891df4 100644 --- a/plugins/corespeed/.mcp.codex.json +++ b/plugins/corespeed/.mcp.claude.json @@ -2,7 +2,7 @@ "mcpServers": { "corespeed": { "type": "http", - "url": "https://api.corespeed.io/mcp/plugin/chatgpt" + "url": "https://api.corespeed.io/mcp" } } } diff --git a/plugins/corespeed/.mcp.json b/plugins/corespeed/.mcp.json index 6891df4..5ffbf5c 100644 --- a/plugins/corespeed/.mcp.json +++ b/plugins/corespeed/.mcp.json @@ -2,7 +2,7 @@ "mcpServers": { "corespeed": { "type": "http", - "url": "https://api.corespeed.io/mcp" + "url": "https://api.corespeed.io/mcp/plugin/chatgpt" } } } diff --git a/plugins/corespeed/skills/cs-api/SKILL.md b/plugins/corespeed/skills/cs-api/SKILL.md index 31e9fcd..441926e 100644 --- a/plugins/corespeed/skills/cs-api/SKILL.md +++ b/plugins/corespeed/skills/cs-api/SKILL.md @@ -8,7 +8,9 @@ description: Use when calling CoreSpeed over HTTP from code, CI, or a headless a CoreSpeed is one authenticated MCP server, `https://api.corespeed.io/mcp`, that carries the tools of the apps an organization has connected, long-term memory, media generation and understanding, live web search, and public social -data. An agent with this plugin installed already has it as an MCP server; this +data. An agent with this plugin installed already has it — or, in Codex, the +plugin surface `https://api.corespeed.io/mcp/plugin/chatgpt` (memory and +connector discovery), which takes the same credentials — as an MCP server; this skill is for code that talks to it directly: a service, a CI job, a script, or a client without OAuth. @@ -26,7 +28,7 @@ decides which tools, accounts, and memories the response contains. | Credential | Who is calling | Use it for | | --- | --- | --- | -| Browser sign-in (MCP OAuth token) | A member, from an OAuth-capable client | Interactive agents. Accepted on `POST /mcp` only | +| Browser sign-in (MCP OAuth token) | A member, from an OAuth-capable client | Interactive agents. Accepted on `POST /mcp` and `POST /mcp/plugin/` (one token, the URL picks the surface) | | `sk-cs-…` API key | The member who created it | CI, services, clients without OAuth | | `sk-csa-…` agent key | An agent principal with its own identity | Unattended agents; reaches the organization's shared accounts only | | Session JWT | A member, from the `cs` CLI or the dashboard | One-off scripts (`cs token`); lives five minutes |