# Connecting an AI agent over MCP

Connecting an AI agent to STRG lets it create buckets, read and write objects and manage access
keys for you, asked in plain words - and if you have no account yet, connecting signs you up. The
server is at `https://mcp.strg.com/mcp`, and the easiest start is **Connect your own agent** in the
dashboard's top bar, which shows the setup for your client ready to copy.

## Setting up your client

Each client has its own place for MCP servers. The configuration needs only the server URL, and the
client opens a browser sign-in when it first connects:

**Claude Code**

```bash
claude mcp add --transport http strg https://mcp.strg.com/mcp
```

With `--scope project`, it goes into `.mcp.json` in your project instead, ready to share with your
team:

```json title=".mcp.json"
{
  "mcpServers": {
    "strg": {
      "type": "http",
      "url": "https://mcp.strg.com/mcp"
    }
  }
}
```

The sign-in then runs from `/mcp` in Claude Code, or from your shell with `claude mcp login strg`.

**Claude Desktop and claude.ai**

The connector is a custom one: in **Customize** → **Connectors**, **Add custom connector** takes
the server URL, `https://mcp.strg.com/mcp`. Claude asks you to sign in when you connect.

On a Team or Enterprise plan, an owner of your organization adds the connector, and each member
then connects it from **Customize** → **Connectors**.

**Codex**

```toml title="~/.codex/config.toml"
[mcp_servers.strg]
url = "https://mcp.strg.com/mcp"
```

The sign-in then runs with:

```bash
codex mcp login strg
```

**Antigravity**

The configuration is in the agent panel's **…** menu, under **MCP Servers**, **Manage MCP Servers**
and **View raw config** - or in `~/.gemini/config/mcp_config.json` (all workspaces) or
`.agents/mcp_config.json` (one workspace). Antigravity takes `serverUrl`, not `url`:

```json title="mcp_config.json"
{
  "mcpServers": {
    "strg": {
      "serverUrl": "https://mcp.strg.com/mcp"
    }
  }
}
```

Antigravity handles the sign-in itself. **Authenticate** beside strg, on the **Customizations** tab
of Agent settings (Cmd + , on macOS, Ctrl + , on Windows and Linux), opens it in your browser. The
authorization code the sign-in ends with then goes into the settings panel with **Submit**, and
strg reconnects on its own.

**Cursor**

The **Add to Cursor** button in the dashboard's **Connect your agent** dialog installs it in one
click. It can also go into `~/.cursor/mcp.json` for every project, or `.cursor/mcp.json` for one
project:

```json title="mcp.json"
{
  "mcpServers": {
    "strg": {
      "url": "https://mcp.strg.com/mcp"
    }
  }
}
```

**Devin Desktop (Windsurf)**

The Cascade panel's **…** menu has **Open MCP config file**, which opens
`~/.config/devin/mcp_config.json` - `%APPDATA%\devin\mcp_config.json` on Windows:

```json title="mcp_config.json"
{
  "mcpServers": {
    "strg": {
      "serverUrl": "https://mcp.strg.com/mcp"
    }
  }
}
```

**Zed**

The server goes into `context_servers` in Zed's settings - or through **Settings** → **AI** →
**MCP Servers**, **Add Server** and **Add Remote Server**:

```json title="settings.json"
{
  "context_servers": {
    "strg": {
      "url": "https://mcp.strg.com/mcp"
    }
  }
}
```

**Rulesync**

```jsonc title=".rulesync/mcp.jsonc"
{
  "mcpServers": {
    "strg": {
      "type": "http",
      "url": "https://mcp.strg.com/mcp"
    }
  }
}
```

This command then generates each tool's own configuration, and the sign-in runs from the tool
itself:

```bash
rulesync generate --features mcp
```

**Other clients**

Most clients accept this for a remote HTTP server:

```json
{
  "mcpServers": {
    "strg": {
      "type": "http",
      "url": "https://mcp.strg.com/mcp"
    }
  }
}
```

A client that works with local (stdio) servers only, or with remote servers but without OAuth, can
reach STRG through the `mcp-remote` bridge, which runs the sign-in in your browser:

```json
{
  "mcpServers": {
    "strg": {
      "command": "npx",
      "args": ["mcp-remote", "https://mcp.strg.com/mcp"]
    }
  }
}
```

## What happens when you connect

A browser window signs you in to STRG - or signs you up, with an email code or GitHub. You then
choose the access key the agent will act as: its buckets, an optional key prefix and its
permissions, on the same form as the *Access Keys* page ([Access keys](https://docs.strg.com/access-keys)). Granting
*Manage Object Lock* asks you to confirm once more, since an Object Lock can never be undone.
**Connect** creates the key and takes you back to your client. The key appears on the *Access Keys*
page like any other, and deleting it there disconnects the agent.

### Connecting with an access key instead

A client can also skip the sign-in and send an access key holding *Use the MCP server* as a header:

```text
Authorization: Bearer <access key id>:<secret access key>
```

The dashboard's **Connect your agent** dialog makes this easy: under **Static credentials** it
creates such a key and shows each client's setup with the key written in. The secret is shown only
that once.

## Example prompts

Once connected, an agent takes requests in plain words, such as:

- Create a private bucket called `my-bucket` in `eu-central-1`.
- List my buckets and the endpoint for each.
- Create an access key that can only read and list objects in `my-bucket`, and show me how to use
  it with the AWS CLI.
- Create an access key that can read and write objects under `photos/` in `my-bucket` only.
- Revoke the access key labelled `ci-uploader`.
- Upload this file to `my-bucket` as `notes/todo.md`.
- Give me a download link for `photos/2024/cat.jpg` in `my-bucket` that is valid for one day.
- Set up CORS on `my-bucket` so that my web app at `https://example.com` can upload from the browser.
- Add a lifecycle rule to `my-bucket` that deletes old versions after 30 days.

## What an agent can do

An agent acts as **one access key**, and can do exactly what that key permits - its permissions,
its buckets and its key prefix - so its reach is always the one you gave it when connecting. A key
the agent creates never exceeds its own. Billing and account settings stay with you, in the
dashboard. If the key has *Act without confirmation*, the agent also receives its secret access key,
so that it can configure its own S3 tools for bulk transfers.

## What you are asked to confirm

Unless the key has *Act without confirmation*, your MCP client asks you before the agent does
anything that cannot be undone - in broad terms, deleting object versions or buckets, locking
objects, changing lifecycle rules, making a bucket public, and creating or revoking access keys. The
question says what is affected, in plain words, and nothing happens until you accept. Everything
else - reads, uploads, ordinary deletes - simply runs, since versioning keeps an earlier version to
go back to. A client that cannot ask is turned away rather than let through, so a question is never
skipped.

## A card first

Connecting creates an access key, so an account without a verified card is asked to add one on the
connect page first. Until then, the tools that create a bucket or an access key answer that a card
is needed and that only you can add one - [Billing](https://docs.strg.com/billing) covers it.

## Next steps

- [Access keys](https://docs.strg.com/access-keys) - every permission a key can carry.
- [Object Lock](https://docs.strg.com/object-locks) - worth reading before granting an agent *Manage Object Lock*.
- [The S3 API](https://docs.strg.com/s3-api/overview) - the operations available and how STRG differs from Amazon S3.
- [Billing](https://docs.strg.com/billing) - your card and your invoices.