Claude Code + AgentValet - Governed MCP for Anthropic's CLI

Requirements

Before you start

Claude Code installed (npm install -g @anthropic-ai/claude-code)

Node.js 18 or later

An AgentValet account (free) - the CLI signs you in via your browser

Setup

One command. No config files to edit.

The AgentValet CLI handles everything: it opens your browser to sign you in, generates an RS256 keypair, registers your Claude Code session as an agent, writes the MCP entry, and installs a CLAUDE.md governance snippet so the agent knows how to use it. No copy-paste, no IDs to track.

terminal

# In your project directory
npx @agentvalet/register

# Browser opens. Sign in. Done.
# The CLI writes:
#   .mcp.json                  - MCP entry, project-scoped
#   CLAUDE.md                  - governance instructions
#   .claude/settings.local.json - prompt hook for status checks

1

Run npx @agentvalet/register in any project directory.

2

Your browser opens to AgentValet. Sign in (or sign up - it's free). The CLI auto-completes registration when you authorize.

3

Open Claude Code in the same directory. It picks up .mcp.json automatically. Run /mcp to confirm agentvalet is loaded.

4

Approve the platforms this agent can access in the AgentValet dashboard. The agent sees only what you grant - and every call is logged.

User-scoped install - prefer one config across every Claude Code project? Run npx @agentvalet/register --scope user and the CLI writes to ~/.claude.json instead of .mcp.json. Restart Claude Code to pick up the change.

Prefer to wire it up by hand?

The CLI is the recommended path. If you'd rather edit config yourself, here's the equivalent .mcp.json:

.mcp.json

{
  "mcpServers": {
    "agentvalet": {
      "command": "npx",
      "args": ["-y", "@agentvalet/register", "mcp-server"]
    }
  }
}

You'll still want to run npx @agentvalet/register once so the CLI can store your agent's private key on this machine - the MCP server reads it at startup.

Alternative: Connect over OAuth

One command. A browser consent. No token on disk.

Claude Code treats AgentValet as a remote MCP server and connects over OAuth 2.1. You approve the connection in your browser. The agent is issued a signing identity, not a raw credential. Nothing long-lived sits on disk.

terminal

# Register AgentValet as a remote MCP server
claude mcp add --transport http agentvalet https://api.agentvalet.ai/mcp/v1/<your-owner-id>

# Then open Claude Code and run /mcp
# Claude opens a browser for OAuth consent.
# The token is stored in your OS keychain and auto-refreshed.

1

Sign in at app.agentvalet.ai and copy your owner id from the dashboard.

2

Run claude mcp add --transport http agentvalet https://api.agentvalet.ai/mcp/v1/<your-owner-id> to register AgentValet as a remote MCP server.

3

Run /mcp inside Claude Code. Claude opens a browser tab for OAuth consent. Approve it, and the agent is provisioned its own signing identity.

4

Approve platforms in the dashboard. Every call is then scoped, checked, and logged. The OS keychain holds the token; auto-refresh keeps it current.

Identity, not credentials. The OAuth consent flow provisions the agent its own signing identity. No long-lived bearer token sits in a config file. This is the same trust model as the npx @agentvalet/register path above, reached a different way.

What changes

Your Claude Code session, governed

Project or user scoped

Per-project .mcp.json for repo-bound agents, or user-level ~/.claude.json for one config across every project.

CLAUDE.md guidance, written for you

A governance section is added to your CLAUDE.md so Claude Code knows when to call AgentValet, what scopes it has, and how to surface approvals.

No keys in your project

API keys never touch your repo or shell. Credentials are decrypted in-memory inside the AgentValet proxy, only at call time.

Scoped per platform

Set exactly what each agent can do. GitHub read-only stays read-only, even if the agent tries to write.

Approve risky calls live

Destructive or financial actions can require human approval. The session pauses, you tap approve in the dashboard, the agent continues.

Full audit trail

Every call logged: agent, platform, action, timestamp. Revoke instantly from the dashboard if something looks wrong.

Claude Code with credentials it never sees.

Before you start

One command. No config files to edit.

One command. A browser consent. No token on disk.

Your Claude Code session, governed

Ship governed Claude Code in under 5 minutes.