> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tatara.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting an agent

> Connect an MCP client to your Tatara brain with browser sign-in or an access token, and manage connected agents.

There are two ways to give an agent access to your brain: sign in from the client through your browser, or issue it an access token.

<Info>
  Every connection gets both read and write access. There is no read-only credential, so connect an agent only if you are comfortable with it creating and editing documents on your behalf.
</Info>

## Sign in from the client

This is the path most MCP clients take. Add the server to the client's MCP configuration:

```json mcp-config.json theme={null}
{
  "mcpServers": {
    "tatara": {
      "type": "http",
      "url": "https://www.tatara.app/api/mcp"
    }
  }
}
```

The first time the client connects, it opens your browser. Sign in to Tatara if you are not already signed in, and you land on a consent screen naming the client:

> **Claude Code wants to connect to your Tatara brain.**
>
> It will be able to read your documents and folders, traverse your brain graph, and create or edit your documents on your behalf.

Choose **Connect** to approve, or **Cancel** to refuse. Approving hands the client its credentials and returns you to your app. The client keeps its own access current from then on, so you do not have to sign in again for every session.

<Note>
  Browser sign-in works with clients that hand control back to an address on your own machine, which covers desktop and command-line clients, plus Claude's hosted client. If your client cannot complete the browser round trip, use an access token instead.
</Note>

## Use an access token

An access token is a long-lived bearer token for an agent that cannot sign in through a browser. Only a workspace owner can create one.

<Steps>
  <Step title="Create the token">
    In Tatara, open **Settings → Access tokens** and choose **New token**. Give it a name that identifies the agent using it.
  </Step>

  <Step title="Copy it immediately">
    The token is shown exactly once, when it is created. Copy it then. Tatara does not store a readable copy, so a lost token has to be replaced.
  </Step>

  <Step title="Send it on every call">
    Configure the client to send the token as a bearer credential:

    ```json mcp-config.json theme={null}
    {
      "mcpServers": {
        "tatara": {
          "type": "http",
          "url": "https://www.tatara.app/api/mcp",
          "headers": {
            "Authorization": "Bearer YOUR_ACCESS_TOKEN"
          }
        }
      }
    }
    ```
  </Step>
</Steps>

Tokens are checked on every call, so revoking one from **Settings → Access tokens** cuts the agent off on its very next request, with no cache to wait out. Disconnecting a browser-signed-in client does not take effect that quickly.

<Warning>
  An access token is a full credential. Anyone holding it can read and write your brain. Keep it out of source control and out of shared prompts, and revoke it the moment it might have leaked.
</Warning>

## Manage connected agents

**Settings → Agent access** lists every client that signed in through the browser, under **Connected apps**, with the date it connected and when it was last used. Choosing **Disconnect** stops that client renewing its access, so it has to sign in again to get a new credential. The credential it already holds keeps working until it expires, up to an hour later.

Agents using an access token are managed from **Settings → Access tokens** instead.

## Provenance

Every document an agent writes records which credential wrote it. The `source` field is stamped from the token's name or the connected client's identity, and it is never something the agent supplies. That is why write tools ignore a `source` you send them.

## If the connection fails

<AccordionGroup>
  <Accordion title="The sign-in page says the request has expired">
    Consent requests are short-lived. Start the connection again from your client and complete it without leaving the tab idle.
  </Accordion>

  <Accordion title="Setup is incomplete">
    Your Tatara account has to belong to a company before an agent can connect. Finish account setup in the web app, then retry.
  </Accordion>

  <Accordion title="The agent reports that its token is not recognized">
    The token was revoked or mistyped. Issue a new one under **Settings → Access tokens** and update the client's configuration. If the agent connected through the browser instead, check whether the client was disconnected under **Settings → Agent access**, and reconnect it.
  </Accordion>
</AccordionGroup>

## Next steps

<Columns cols={2}>
  <Card title="The MCP server" icon="wrench" href="/mcp/overview">
    What your agent can do once it is connected.
  </Card>

  <Card title="Agent skills" icon="code" href="/skills">
    Install the skills that teach your agent to write correctly.
  </Card>
</Columns>