# Connect an agent

Choose your app in the [connection guides](/docs/connect). Copy its single-use connection message from [Connections](/agents/connections). For server integrations, create a workspace API key in [Settings → Integrations](/agents/billing#settings-integrations).

RateLoop's public Alpha workspace MCP endpoint uses Streamable HTTP and host-native OAuth:

- Name: `rateloop-workspace`
- URL: `https://www.rateloop.ai/api/agent/v1/mcp`
- Download: [`/integrations/rateloop-workspace-mcp.json`](/integrations/rateloop-workspace-mcp.json)

Its authorization server accepts only public PKCE clients. A host registers dynamically or uses the HTTPS URL of a
client ID metadata document as its `client_id`. RateLoop fetches that document, requires its `client_id` to match that
URL, sends approval only to a callback it lists (loopback callbacks on any port), and names its host on the consent
page.

The endpoint serves both MCP eras. Requests carrying
`params._meta["io.modelcontextprotocol/protocolVersion"]` are served under the current revision, `2026-07-28`, which
removed the `initialize` handshake and protocol-level sessions: every request carries its own version and client
capabilities, `server/discover` reports supported versions and capabilities, and the `MCP-Protocol-Version`,
`Mcp-Method`, and `Mcp-Name` headers must match the body they route on. Discovery, tool and resource lists, and
resource reads carry the revision's `ttlMs` and `cacheScope` cache hints: discovery and lists are private to the
credential and stale at once, and the static review card HTML may be cached publicly for five minutes. Requests without
that metadata still negotiate
`2025-11-25`, `2025-06-18`, or `2025-03-26` through `initialize` and `MCP-Session-Id`.

Two things are only reachable through the handshake revisions, because the current revision removed the mechanism they
depend on. The one-time `/connect/aci_...#...` claim binds the connection URL to the MCP session that presented it, so
`rateloop_connect_workspace` and `rateloop_claim_connection_intent` require a `2025-11-25` session; every tool after the
connection works at `2026-07-28`. Queued owner-approval forms were delivered on the GET event stream, which
`2026-07-28` removed along with `Last-Event-ID` resumption and `DELETE` session termination; a `2026-07-28` client uses
the browser approval path. Each of these answers with an error naming the version or the replacement rather than
failing silently.

## MCP compatibility window / MCP-Kompatibilitätsfenster

**English.** The current compatibility window is stateless `2026-07-28` plus handshake revisions `2025-11-25`,
`2025-06-18`, and `2025-03-26`. RateLoop does not silently mix the two eras: per-request protocol metadata selects the
stateless route; its absence selects the initialize/session route. Missing or contradictory modern routing headers,
modern `initialize`/GET/DELETE calls, a modern revision requested through `initialize`, and unsupported revisions return
explicit JSON-RPC errors. This list is the supported window, not a promise of an unannounced downgrade or a removal
date; narrowing it requires a documented breaking release.

**Deutsch.** Das aktuelle Kompatibilitätsfenster umfasst die zustandslose Revision `2026-07-28` sowie die
Handshake-Revisionen `2025-11-25`, `2025-06-18` und `2025-03-26`. RateLoop vermischt beide Verfahren nicht stillschweigend:
Protokollmetadaten in jeder Anfrage wählen den zustandslosen Weg, ihr Fehlen den Initialize-/Sitzungsweg. Fehlende oder
widersprüchliche moderne Routing-Header, moderne `initialize`-/GET-/DELETE-Aufrufe, eine per `initialize` angeforderte
moderne Revision und nicht unterstützte Revisionen liefern eindeutige JSON-RPC-Fehler. Diese Liste ist das unterstützte
Fenster, weder eine Zusage für ein unbemerktes Downgrade noch ein Entfernungsdatum; jede Verengung erfordert eine
dokumentierte inkompatible Version.

The downloadable JSON is the URL-only configuration used by the bundled Codex and Claude plugins. MCP does not define
a universal client configuration file: VS Code uses `servers`, Gemini CLI uses `mcpServers` with `httpUrl`, and hosted
APIs use application-managed authorization. The download contains no bearer token, API key, authorization header, or
workspace identifier. Use the primary Codex path or one named configuration below instead of renaming fields by guess.

In **Connections**, choose the app where the agent runs (the app, not the model: Claude inside Cursor is set up
through Cursor), finish that app's one-time setup, then copy its message. After the server is installed, paste the
complete single-use RateLoop `/connect/aci_...#...` message into the agent once. Every message asks the agent to
connect with the private link, to stop and ask you to add RateLoop when no RateLoop tools are available, and never to
open, repeat or share the link, and it states when the link expires in UTC. The Codex message uses the plugin mention
and skills described below, the Claude Code message names the plugin's connection skill, and every other app is asked
to call `rateloop_connect_workspace` once. Except in Codex, whose message names its review skill, the message also asks
the agent to check each answer with RateLoop and show its review status: some apps, including Claude on the web and
Claude Desktop, do not pass RateLoop's own instructions to the model. Server integrations use a workspace API key instead of a message.
The preferred `rateloop_connect_workspace` tool claims the intent, loads its bound policy, and verifies the connection in
one resumable call. Installation, trust, organization policy, and OAuth consent remain controls of the agent host; they
cannot be bypassed by a prompt.

Installing the server does not start a background reviewer and does not make an already-running task call RateLoop. The
active task must expose the workspace tools. A new connection prefers `rateloop_connect_workspace`; only when that tool
is unavailable does it use `rateloop_claim_connection_intent`, `rateloop_get_agent_context`, then
`rateloop_verify_connection`. Do not report the workspace connected until either path returns successful verification.
Before every eligible output, the agent reloads context and calls `rateloop_evaluate_review_requirement`. A required review then follows
`rateloop_request_review -> rateloop_wait_for_review -> rateloop_get_review_result` within the exact authority returned
by the workspace.

Freeze the reviewer-visible strings before hashing them. Human review accepts up to **131,072 characters per field**
for `sourcePayload` and `suggestionPayload`. Each complete serialized MCP request must also fit **65,536 UTF-8 bytes
(64 KiB)**, including both fields, JSON escaping and the envelope. Check the evaluation and eventual review request
sizes before creating an opportunity. Human-only evaluation receives hashes and cannot check the later payload size.
Keep the source to authorized context needed to judge the complete candidate answer, then reuse both strings
byte-for-byte. Never submit a summary and attach its rating to the longer original.

Rating AI supports at most **3,000 characters per field** and the model's token limit. Longer material within the
human material and transport limits still uses the same opportunity: AI is `unavailable` with `rating_input_too_long`
and no job, while human review follows the owner's policy. Do not skip an eligible human review or create an extra
review because AI cannot rate its length. AI-only policy does not authorize a human fallback.

Workspace owners inspect and change question, frequency, response window, reviewer group, and agent authority in
**Agents → Setup → Human review**. When multiple agents are active, a compact selector chooses which agent's policy to edit; the
workspace reviewer roster follows the editor. A saved policy change does not require a new intent; the next context read
returns the active version. A new intent is required after deletion or revocation.

The generated Codex message includes both the structured **RateLoop Workspace** plugin mention and an explicit
`$rateloop-workspace-connection` skill invocation. This dedicated plugin contains only the OAuth-protected workspace MCP
server, so the host must activate that connection rather than silently fall back to another tool. The structured mention is usable only when `rateloop-workspace@rateloop` is already available in Codex's
native plugin inventory. RateLoop does not currently publish a public plugin marketplace or repository install source.
If Codex offers no native plugin action, do not attempt a repository install; report the host blocker.

If Codex installs the already-available inventory entry, its skills and tools load in one new task, not the task that
installed it. Start that new task and paste the same connection message once while its URL is still unclaimed. Do not
wait for the running task to discover newly installed skills or tools.

Initial OAuth approval establishes a grant that works across tasks and renews short-lived access automatically while it
remains active. Fresh authorization is required when the grant expires at its absolute lifetime or is revoked, the
workspace is deleted, or a host restores a stale credential. A plugin that was already loaded in the current task may
offer **Continue** after OAuth; follow that action when it actually appears. Do not invent a reload button or settings
path, start a second login or nested runtime, or report success before verification. Connection operations are
closed-domain, non-destructive, idempotent MCP actions;
review requests remain bound to the saved policy and any required owner approval.

### Plugin installed, but tools are missing?

Use these task boundaries:

- If the plugin is installed during the current task, start exactly one new Codex task and paste the same connection
  message once while its URL is still unclaimed.
- If an already-loaded plugin completes native OAuth before a claim, continue in the same task and do not paste the
  message again. Use **Continue** when Codex offers it.
- After invalid_grant, stop RateLoop calls, never reuse the old connection URL, recover only through host-presented
  plugin OAuth, and then paste one new targeted reconnect message into one fresh task.
- Complete reconnect source confirmation and owner approval in the task that holds the fresh reconnect message; do not
  paste it again.
- After verification, future tasks rediscover the connection with rateloop_get_agent_context and do not need the
  connection message.
- One active RateLoop OAuth grant renews short-lived access across tasks for up to 90 days; an older task must never
  revoke that grant.

If the fresh post-install task still lacks the tools, inspect the native plugin inventory once. Do not reinstall an
enabled plugin: installation and OAuth authorization are separate, and reinstalling does not repair a stale grant or
an organization-policy block. A standalone MCP registration named rateloop-workspace must not coexist with the
RateLoop Workspace plugin. It can split tool and OAuth state from the plugin.

If the workspace tools are present but a call definitively returns both `invalid_grant` and
`OAuth authorization required`, the agent stops making RateLoop calls immediately. This means the grant reached its
absolute expiry, was explicitly revoked, belongs to a deleted workspace, or the host supplied an unusable credential;
normal short-lived access renewal does not need approval. Repeatedly calling the tools is not a connection test.
Follow only an OAuth action presented by the plugin host. If Codex shows none, report the host blocker; standalone MCP
login or logout does not repair plugin authentication. After OAuth, open **Connections** and use **Reconnect** on the
saved agent, or **Create a new connection message** if no saved agent exists. The targeted reconnect preserves the
saved agent and review settings while the inactive credential family stays revoked. Do not reset another MCP
server, reinstall the plugin, start a nested agent, or repeat authorization attempts.

### Codex is connected to another workspace

One Codex OAuth connection can have only one active RateLoop workspace binding. Reconnect an existing active or saved
disconnected agent from its RateLoop connection screen; do not reuse an older untargeted connection message. The
targeted reconnect uses two explicit decisions and never exposes or replaces the bearer credential:

1. The agent reports: **Moving this Codex connection will disconnect it from its current RateLoop workspace and replace
   the selected agent’s previous connection.** The current credential holder must explicitly confirm that consequence
   in the agent task.
2. The agent records that confirmation with the dedicated move-confirmation tool. If the host has not refreshed its
   tool list yet, the same confirmation works through `rateloop_connect_workspace`: the agent privately appends the
   server-provided `confirm_move` value to a one-use copy of the preserved URL fragment. The unmodified URL remains
   private and an ordinary retry never confirms the move.
3. RateLoop then gives the selected agent’s workspace owner a website approval. The owner approves or denies the move
   while signed in to RateLoop.
4. After approval, the agent retries the unmodified privately preserved connection URL. RateLoop moves the one active
   binding, invalidates the replaced sessions, preserves the selected agent and its saved review configuration, and
   verifies the connection.

The agent cannot approve the owner’s website decision, and the owner’s approval cannot substitute for the credential
holder’s confirmation. Neither surface reveals the other workspace’s identity. If RateLoop instead reports the legacy
`workspace_conflict`, create a targeted reconnect message for the intended agent and retry in the same task. Do not
claim an invisible OAuth prompt is pending, copy the connection secret again, expose a workspace identifier, handle a
bearer token, or change MCP configuration.

The fallback marker is valid only with `rateloop_connect_workspace`; the lower-level claim tool rejects it. The agent
must never display the original URL, its fragment, or a marked copy.

Do not put credentials in the MCP configuration. Do not create a background service or polling task to keep a connection
alive.

## Recommended installation path for the first demonstration

The first hands-on demonstration can use the downloadable **RateLoop Workspace 0.1.21 for Claude Code**:
[plugin archive](/integrations/plugins/rateloop-workspace-claude-code-0.1.21-public-alpha.tar.gz),
[SHA-256 checksum](/integrations/plugins/rateloop-workspace-claude-code-0.1.21-public-alpha.tar.gz.sha256), and
[file manifest](/integrations/plugins/rateloop-workspace-claude-code-0.1.21-public-alpha.tar.gz.json).
It contains the two workspace skills, two Haiku helper subagents for bounded lookups and checks, the URL-only MCP
configuration, the `PreToolUse`, `PostToolUse`, and `Stop` hooks, and the model-selection module described below. It
needs no repository access or marketplace. The archive contains only 24 named plugin files, with no account
or workspace configuration. This download targets the public Alpha; it does not establish a commercial
release or a verified host connection.

**Verification status.** Deterministic protocol, OAuth, plugin packaging and hook checks are separate from an installed-host
workspace connection. No complete release smoke test covering installation, native OAuth, connection, a review and
recovery on a named host version has been recorded for this bundle. Both plugin hosts retain the **Supported** tier.
A qualifying run must capture the host and plugin versions, application SHA, negotiated MCP revision, trusted hooks,
and whether delivery enforcement was advisory or actually demonstrated.

### Claude Code with the downloadable plugin

1. Use an already installed and signed-in Claude Code 2.1.196 or newer, plus Node.js 24 for the hooks. Record `claude --version` for
   the demonstration. On macOS or Linux, run these commands from a directory where the new folder does not yet exist.
   They stop if a download or checksum check fails. The checksum detects a changed download; it is not a separate
   signature or evidence that the host flow has passed:

   ```sh
   mkdir rateloop-claude-0.1.21 &&
   cd rateloop-claude-0.1.21 &&
   curl --fail --show-error --silent --remote-name https://www.rateloop.ai/integrations/plugins/rateloop-workspace-claude-code-0.1.21-public-alpha.tar.gz &&
   curl --fail --show-error --silent --remote-name https://www.rateloop.ai/integrations/plugins/rateloop-workspace-claude-code-0.1.21-public-alpha.tar.gz.sha256 &&
   shasum -a 256 -c rateloop-workspace-claude-code-0.1.21-public-alpha.tar.gz.sha256 &&
   tar -xzf rateloop-workspace-claude-code-0.1.21-public-alpha.tar.gz &&
   claude --plugin-dir ./rateloop-workspace
   ```

   Review the plugin files and approve only the host trust prompts you intend to accept. Its `.mcp.json` registers the
   protected server; `claude mcp add` alone does not install these hooks and skills. The archive has to be extracted
   before passing the directory to Claude. This follows [Claude Code's local plugin loading instructions](https://code.claude.com/docs/en/plugins).

2. Run `/mcp` and authorize the plugin's RateLoop Workspace server in the browser as the workspace owner: OAuth
   discovery, client registration (Claude Code's client ID metadata document or dynamic registration), S256 PKCE, and
   consent for the safe connection scopes. Do not also register a standalone
   `rateloop-workspace` server; the plugin owns that name.
3. Paste the connection message from **Connections** once. The agent calls `rateloop_connect_workspace`, or the granular
   `rateloop_claim_connection_intent -> rateloop_get_agent_context -> rateloop_verify_connection` fallback, and reports
   **RateLoop is connected and ready.** only after verification succeeds.
4. Send an eligible output through the bound flow: `rateloop_evaluate_review_requirement`, then when the policy requires
   it `rateloop_request_review -> rateloop_wait_for_review -> rateloop_get_review_result`; for `customer_replies:v1`
   record the downstream disposition with `rateloop_record_review_outcome`.
5. Pass `--plugin-dir` again for every new session, using the absolute extracted plugin path when starting from another
   directory. Rediscovery through `rateloop_get_agent_context` without a second paste depends on the host keeping the
   grant across sessions, which the recorded run must confirm. For an update, use a newly versioned archive and a new
   extraction directory. To stop loading it, omit `--plugin-dir`; revoke its connection separately in RateLoop if needed.

**Remaining installed-host check:** install from this download in a clean client profile, authorize, connect, consume a
real review, restart and rediscover the connection, then revoke and reconnect using a fresh owner-created message. Record
the archive hash along with the host version and application SHA. Successful unpacking and hook checks do not complete
that OAuth and review test. Interactive Claude use remains advisory; the plugin does not prove that an output was held.

### Model selection in the Claude Code plugin

The plugin's model-selection module uses Claude Code's function hooks. At a session's first prompt it reads
`rateloop_get_model_guidance` for the connected agent, identifies the workflow locally from the connection's allowed
workflows, and, when a cheaper Claude model met your workspace's human-review standard for that workflow, runs the
session and its inheriting general-purpose subagents on that model. It never selects a model above the one you chose.
Security, authentication, migrations, production operations, legal, medical and financial work, long prompts and
requests for a specific or stronger model keep your model. A request for a stronger model, a rejected review of a
stepped-down answer, repeated tool failures or a `/model` change restores your model for the rest of the session.

The first time it reads guidance, Claude Code asks you to allow the read-only `rateloop_get_model_guidance` tool; allow
it always, or add `mcp__plugin_rateloop-workspace_rateloop-workspace__rateloop_get_model_guidance` to
`permissions.allow` (headless runs need the rule or `--allowedTools`). Until then the session keeps your model.
The status line shows the choice. `/rateloop-model` explains it, `/rateloop-model keep` restores your model and
`/rateloop-model refresh` reloads guidance. In `/config`, **Model selection** is `automatic` (default), `recommend` or
`off`, and **Trial share** (default 10%, at most 20%) lets a labelled share of sessions try a cheaper model that has
too few reviews, only on a workflow whose current model already meets the standard. Requests stay on your own Claude
Code credentials; RateLoop never receives prompt text for this and never sits between Claude Code and Anthropic.
Automatic selection names Anthropic API model IDs; Bedrock, Vertex and gateway model IDs receive recommendations only.
The module also replaces each evaluation's Claude model spans with the models that actually answered. The plugin's hook
tests cover this behavior; a recorded installed-host run is still outstanding.

### Codex with the local marketplace

The checkout declares a local marketplace at `.agents/plugins/marketplace.json` whose `rateloop-workspace` entry points
at `./plugins/rateloop-workspace` with `installation: AVAILABLE` and `authentication: ON_INSTALL`. OpenAI's plugin
documentation, checked on 2026-09-05, states that the desktop app reads marketplace files and lists their plugins in the
Plugins directory under a marketplace selector, that the CLI offers a `/plugins` browser, that bundled skills become
available in a new session, and that plugin hooks stay skipped until the user reviews and trusts them. Install RateLoop
Workspace only through that native surface, then follow the Codex task boundaries above: one new task, one paste of the
still-unclaimed message, native OAuth, `rateloop_connect_workspace`, verification. Whether the pinned Codex build shows
this local marketplace is one of the facts the recorded run must capture.

### Recovery

- Revoked grant, deleted workspace, or absolute-lifetime expiry: the protected server answers with the OAuth challenge.
  Follow the host-presented OAuth action, create **Reconnect** for the saved agent in **Connections**, and paste that one
  message into one fresh session or task. Stale-grant handling is in _Plugin installed, but tools are missing?_ above.
- Moving to another workspace: the dual-consent flow in _Codex is connected to another workspace_ above.
- A new session or task after verification needs no paste; one active grant renews short-lived access for up to
  90 days.

## Support status

Support describes the app or integration, not the model. The [connection guides](/docs/connect) list each app's current status and setup steps.

- **Supported:** The bundled integration path is tested against RateLoop's own contracts; the pinned-client release smoke test is still outstanding.
- **Experimental:** This integration has not passed a RateLoop release smoke test at a pinned client version.
- **Release-tested:** A release-gated install, authorization, lifecycle, and tool smoke test passed at a named client version.
- **Unsupported:** The host lacks a capability the protected workspace connection requires.

No host is release-tested yet. Partial native checks covered VS Code/Copilot connection and a fresh conversation, and Claude Code plugin OAuth. They did not establish a complete review lifecycle, forced renewal, revocation, recovery, or a delivery gate. All integrations remain advisory: your workflow controls output delivery.

The commands below were checked against vendor documentation on 2026-07-17 (Windsurf, Zed, JetBrains, and n8n on 2026-08-21; Claude on the web and Claude Desktop on 2026-10-12). Those checks do not replace an installed-client test.

### Claude Code

Register the protected server at user scope, open Claude Code, run `/mcp`, and complete the browser authorization before
pasting the single-use connection message:

```sh
claude mcp add --scope user --transport http rateloop-workspace https://www.rateloop.ai/api/agent/v1/mcp
```

This is the generic remote-server path. It does not install the repository's separate Claude plugin hooks or prove that
Claude held an output. See [Anthropic's remote MCP and OAuth instructions](https://docs.anthropic.com/en/docs/claude-code/mcp).

### Claude on the web and Claude Desktop

Add RateLoop as a custom connector. Claude reaches the server from Anthropic's cloud, so one connector works on the
web and in Claude Desktop:

1. Open **Customize → Connectors**, choose **+ Add**, then **Add custom connector**.
2. Name it RateLoop and enter `https://www.rateloop.ai/api/agent/v1/mcp`.
3. Keep Claude's default sign-in settings, add the connector and approve the RateLoop OAuth consent. If sign-in
   fails, choose **Register automatically** for the OAuth client.
4. In a chat, turn on RateLoop under **+ → Connectors**, then paste the single-use connection message from
   **Connections**.

On Team and Enterprise plans, an owner first adds the connector under **Organization settings → Connectors**; members
then connect it under **Customize → Connectors**. Free plans allow one custom connector. Claude does not pass
RateLoop's own instructions to the model, so it checks answers only where asked: the connection message asks for its
chat, and in a new chat you ask Claude once to check each answer with RateLoop. Claude then shows the
[live answer rating card](#live-answer-rating-cards) inline after each answer. See
[Anthropic's custom connector instructions](https://support.claude.com/en/articles/11175166-getting-started-with-custom-connectors-using-remote-mcp).
No Claude connector run is recorded in a RateLoop release smoke test.

### GitHub Copilot Chat in local VS Code

Put the protected server in the local IDE's user or workspace `mcp.json`, start it, then use VS Code's **Auth** action
when it appears:

```json
{
  "servers": {
    "rateloop-workspace": {
      "type": "http",
      "url": "https://www.rateloop.ai/api/agent/v1/mcp"
    }
  }
}
```

Do not add an invented `oauth.clientId` or redirect URI. If organization policy blocks MCP or authorization cannot be
completed, prompts cannot bypass that control. This configuration is for
[Copilot Chat in local VS Code](https://code.visualstudio.com/docs/agents/reference/mcp-configuration), not GitHub's
cloud agent or code review.

### Gemini CLI

First sign in to Gemini CLI with a Gemini Code Assist Standard/Enterprise license or a paid Gemini API key.
Personal Google sign-in, including Google AI Pro and Ultra, ended on 18 June 2026, as described in
[Google’s transition notice](https://developers.googleblog.com/an-important-update-transitioning-gemini-cli-to-antigravity-cli/).
Antigravity is a different client; its RateLoop integration has not been tested.

Register the protected server at user scope, start Gemini CLI, then run `/mcp auth rateloop-workspace` if authentication
is required:

```sh
gemini mcp add --scope user --transport http rateloop-workspace https://www.rateloop.ai/api/agent/v1/mcp
```

The equivalent `settings.json` entry uses `httpUrl`, not `url` plus `type`:

```json
{
  "mcpServers": {
    "rateloop-workspace": {
      "httpUrl": "https://www.rateloop.ai/api/agent/v1/mcp"
    }
  }
}
```

Keep `trust` at its default `false` so tool confirmations remain available. See
[Gemini CLI's Streamable HTTP and OAuth guidance](https://geminicli.com/docs/tools/mcp-server/).

### Windsurf

Add the protected server to `mcp_config.json`, refresh the MCP server list in the assistant panel, then approve the
OAuth consent when the host opens it. The remote transport field is `serverUrl`, not `url`:

```json
{
  "mcpServers": {
    "rateloop-workspace": {
      "serverUrl": "https://www.rateloop.ai/api/agent/v1/mcp"
    }
  }
}
```

### Zed

Add the protected server under the top-level `context_servers` object in `settings.json`. With no `Authorization` header
configured, Zed starts the OAuth flow on first use:

```json
{
  "context_servers": {
    "rateloop-workspace": {
      "url": "https://www.rateloop.ai/api/agent/v1/mcp"
    }
  }
}
```

### JetBrains AI Assistant

Add the RateLoop server URL in the IDE settings under **AI Assistant** › **Model Context Protocol**, apply, and use the
**Authorize** action when it appears. Remote streamable HTTP support in this host is recent; if the Authorize action does
not appear after applying, restart the server entry from the same settings page.

### Headless SDK or CI

Do not paste a workspace connection message into CI or place its one-time URL in an environment variable. In [**Settings → Integrations**](/agents/billing#settings-integrations), under **API keys**, create a scoped workspace API key and store it only in the server environment. The current SDK
and CLI are not publicly released: check `npm view @rateloop/sdk version` and the package's export version before using the
[SDK examples](./sdk.md). The private application checkout is not a public installation path. Until release, use a
published interactive workspace MCP client for agent review, or a direct server integration built against the documented
API. For a direct API request, success means the authorized operation returns a response for the intended workspace;
that is separate from an MCP agent connection and does not prove review-loop enforcement. On key expiry or revocation,
create a new scoped key in **Settings → Integrations**, update the server secret, verify an authorized request, and revoke the old
key. There is no host OAuth or connection-intent recovery step in this setup path. No headless SDK native smoke run is recorded.

### n8n

First run `npm view n8n-nodes-rateloop version`. A `Not Found` response means the community package has not been
published and cannot be installed yet; this connection recipe is then a release preview. Once npm lists 0.1.0 or
later, install `n8n-nodes-rateloop`, create the RateLoop API credential with a workspace API key and this deployment's
base URL, and run the credential test before the first workflow execution. n8n's generic OAuth2
credential cannot complete this server's PKCE dynamic-registration flow, so the packaged nodes use the workspace API-key
method; the generic MCP client node is not the supported path. A successful credential test confirms the key and
base URL, not that a review workflow is installed or enforced. On key expiry or revocation, create a new scoped key in
**Settings → Integrations**, update the n8n credential, rerun its test, and revoke the old key. Do not use a one-time MCP
connection message or host OAuth for these packaged nodes. No native n8n run is recorded.

### Hosted APIs and GitHub cloud agents

OpenAI and Anthropic hosted MCP connectors are application-managed: the caller must obtain and supply authorization and
must not place tokens in prompts or static public configuration. GitHub Copilot cloud agent and code review are a
different product from local Copilot Chat; GitHub currently documents that they cannot connect to a remote OAuth MCP
server. Do not present those cloud surfaces as connected to a workspace without a supported, authenticated integration. A
caller-managed SDK or framework integration must retain the exact workspace scopes and owner review policy.

Cursor or another host should not be presented with an install link, client ID, redirect URI, or copied JSON until that
exact setup has been checked against its current vendor documentation and exercised in a RateLoop release smoke test.

For the agent-readable packet fields, export routes, local verification commands, framework cross-references, and exact
non-claims, read [`evidence.md`](./evidence.md). The browser version is [`/docs/evidence`](/docs/evidence).
Framework-native LangGraph, OpenAI Agents, Claude Code, and MCP elicitation contracts are documented in
[`framework-integrations.md`](./framework-integrations.md).

Generic MCP and ordinary Codex hooks are advisory: the host can bypass them and they do not establish that output remained
blocked. Your workflow controls when an output is delivered.

Deleting a RateLoop workspace revokes its OAuth token family, access tokens, refresh tokens, connection intent, and agent
integration. On the next RateLoop Workspace invocation, the protected MCP server should return the standard OAuth
authorization challenge so the host can request fresh consent. If no protected tools or native action appears, use the
stale-plugin recovery above.

## Host notes

- The `rateloop-workspace` plugin contains the authenticated workspace server, connection skill and ongoing review loop
  for Codex and Claude. It grants no workspace access by installation alone.
- Codex requires the plugin in its native inventory. For Claude Code, use the versioned workspace-plugin download
  above and load it with `--plugin-dir`. No public repository-backed install source is released. Do not add a second
  MCP entry manually for an enabled workspace plugin.
- Do not present the downloadable plugin configuration as universal client JSON; use the named client syntax above.
- A native VS Code manifest will be published only after RateLoop has verified and preregistered its public OAuth client
  ID and redirect behavior. No client ID or redirect URI is guessed in this repository.
- Cursor installation metadata will be published only after its current deep-link format is verified. The repository does
  not emit an unverified install link.

## Live answer rating cards

A connected agent can show a live RateLoop card beside a completed answer in a host that supports MCP Apps. Human responses and advisory AI ratings appear separately. The card identifies the exact answer version, shows its last check, refreshes while visible, and offers manual Refresh. An early majority can end a review before every reviewer responds.

The workspace plugin instructs the agent to show a card for completed substantive answers. Progress and rating updates do not generate new cards. Outside-workflow answers, failed evaluations without an opportunity, and material above the human material or MCP transport limits are explicitly unevaluated. An answer above the AI capability alone retains the same opportunity and card; its AI status is unavailable and its human status follows the owner's policy. A summary's rating never represents a longer answer. An edited answer needs a new review; retries reuse the original review.

The card does not submit reviews, change policy, authorize sending, or replace required human approval. Installing the plugin does not capture every conversation or guarantee every output is intercepted. Card placement and refresh support depend on the host; unsupported clients receive a text status. The Codex compatibility probe was visually confirmed on 29 September 2026. On 12 October 2026 the production card rendered and refreshed through the official MCP Apps host bridge (`@modelcontextprotocol/ext-apps` 2.0.3) in a sandboxed Chromium frame; that check does not replace a run inside Claude. Production review-flow acceptance and ChatGPT surface verification are recorded separately in the native-host engineering evidence.