# auth.md

Kody is an OAuth-protected MCP personal assistant. Agents connect at
`https://kody.codes/mcp` from an existing MCP host. People complete sign-in and
consent in the browser; do not ask anyone to paste secrets or tokens
into chat.

## Add the MCP server

1. Point the host at `https://kody.codes/mcp`.
2. Complete the OAuth flow the host opens. Sign in to Kody if needed,
   then approve access.
3. The account email must be verified before authorize can finish. If
   authorize asks to verify, keep that tab open, finish verification
   from the email link or `/pending-verification`, then continue.
4. After the connection works, call `search` before `execute`.

Client-specific setup (Cursor, ChatGPT, Claude Desktop, Claude Code,
Codex, Copilot, Grok, OpenCode) lives on `/onboarding`. A no-account
capability tour is at `https://kody.codes/guides/what-is-kody.md`.

## OAuth

- Authorization server: `https://kody.codes/.well-known/oauth-authorization-server`
- Protected resource: `https://kody.codes/.well-known/oauth-protected-resource`
- Resource: `https://kody.codes/mcp`
- Scopes: `profile`, `email`
- Dynamic client registration: `https://kody.codes/oauth/register`
- Client ID Metadata Documents (CIMD) are supported.

## agent_auth

```json
{
  "skill": "connect-kody",
  "register_uri": "https://kody.codes/oauth/register",
  "methods": [
    {
      "type": "oauth2",
      "grant_types": [
        "authorization_code",
        "refresh_token"
      ],
      "authorization_endpoint": "https://kody.codes/oauth/authorize",
      "token_endpoint": "https://kody.codes/oauth/token",
      "registration_endpoint": "https://kody.codes/oauth/register",
      "client_id_metadata_document_supported": true,
      "scopes": [
        "profile",
        "email"
      ],
      "resource": "https://kody.codes/mcp",
      "bearer_methods_supported": [
        "header"
      ]
    }
  ]
}
```