Remote MCP Server

AgentOnboard provides a hosted, remote Model Context Protocol (MCP) server. This allows AI agents in Claude Code, Cursor, Codex, OpenCode, and autonomous runtimes to mint short-lived, domain-scoped session tokens without installing any local machine CLI or storing credentials globally.

Endpoint & AuthenticationCopy Anchor Link

POST https://agentonboard.xyz/api/mcp

• Transport: HTTP / SSE transport adhering to Model Context Protocol specification (2024-11-05).
• Header: Every request to the MCP endpoint must provide your AgentOnboard API key:

  Copy Text

  Authorization: Bearer aon_live_...

Exposed ToolsCopy Anchor Link

The AgentOnboard Remote MCP server exposes two core tools to connected agents:

1. get_tokenCopy Anchor Link

Mints an ephemeral 5-minute RS256 JWT scoped to the target service's hostname.

Input SchemaCopy Anchor Link

get_token automatically extracts and normalizes the input into a bare lowercase hostname.

Output ResponseCopy Anchor Link

The tool returns structured JSON:

{
  "token": "eyJhbGciOiJSUzI1NiIs...",
  "expires_at": 1740000300,
  "domain": "notes.com"
}

The agent extracts token and sends it to the partner service as:

Authorization: Bearer <token>

2. whoamiCopy Anchor Link

Inspects the currently connected AgentOnboard identity. Useful during agent setup or diagnostics to verify connectivity without minting domain tokens.

Input SchemaCopy Anchor Link

None.

Output ResponseCopy Anchor Link

{
  "email": "developer@example.com",
  "key_prefix": "aon_live_abcd"
}

Universal MCP ConfigurationCopy Anchor Link

Any agent or client that supports standard MCP configuration can connect using the following snippet:

{
  "mcpServers": {
    "agentonboard": {
      "type": "http",
      "url": "https://agentonboard.xyz/api/mcp",
      "headers": {
        "Authorization": "Bearer aon_live_your_key_here"
      }
    }
  }
}

Security GuaranteesCopy Anchor Link

1. Master Key Isolation: Your long-lived aon_live_... key is configured only in your client's MCP settings or environment. It is never exposed in the agent's prompt context, never committed to git, and never sent to third-party partner APIs.
2. Audience-Bound Tokens: Tokens minted by get_token contain an aud claim bound strictly to the requested domain. A token minted for notes.com cannot be used on github.com.
3. Strict 5-Minute Lifespan: Tokens expire automatically after 300 seconds (iat + 300). There is no persistent refresh token stored on disk.
4. Local Verification by Partners: Partners verify tokens in their own process using AgentOnboard's public JWKS (https://agentonboard.xyz/.well-known/jwks.json). AgentOnboard is never in the request path of your actual API calls.

Next StepsCopy Anchor Link

• Connect Your Agent — One-click setup prompts and client-specific guides for Cursor, Claude Code, Codex, and others.
• Publishing auth.md — Learn how partner services declare their accepted audience and endpoints to agents.