Skip to content

Claude Code

Connect Claude Code to Mission Control's governed MCP tools. This configures tool access; it does not route Claude Code's own model inference through /v1.

Prerequisites

Use a Claude Code build that supports MCP revision 2026-07-28 and remote HTTP authorization. The repository tests the official MCP TypeScript client, not a pinned Claude Code release, so verify your installed client's protocol support before relying on this recipe. You need an active person, an active Team membership with own-key creation permission and allowed tools, and browser access to the Console. See Connect an AI client for the shared consent and revocation lifecycle.

Run these commands from the local working directory whose Claude Code configuration you want to use. Replace the fictional gateway URL with the inference listener origin:

claude mcp add --transport http mission-control https://gateway.example.test/mcp
claude mcp list

Use the MCP URL your deployment shows under Connect a client; https://gateway.example.test is a placeholder.

Sign in from Claude Code

  1. Add the server with the command above and open Claude Code in the same working directory.
  2. Open /mcp, select Mission Control, and follow the client's authentication prompt if sign-in does not start automatically.
  3. Complete the browser consent procedure: sign in, inspect the requesting client, choose the Team, select explicit tools, and approve.
  4. Return to /mcp and check connection status, then request discovery of the available tools. A new connection requires completing this sign-in; no gateway restart or configuration restart is needed.

What Claude Code sees

  • Tools are named server__tool, for example crm__lookup-customer. Claude Code prefixes them with the MCP server name you chose.
  • tools/list returns eligible tools allowed by catalog ∩ Team allowance ∩ key policy. Human administration roles do not grant tool invocation. A tool outside that effective policy or otherwise ineligible is absent, not disabled.
  • Every governed call records a canonical Request with its logical key and connection credential-version provenance. Use Observe → Requests: keys.user.manage permits exact own-key Request reads, while broader Team Request metadata and Observe → Traces require observability.read for that Team. Own-key Request access never grants the whole shared Trace. Captured content and export remain separately permissioned.
  • A tool on a per-user Connector answers with a link to My connections until you connect your own account there; Claude Code shows that text as the tool result. After you connect, the same call succeeds with your account. See Use your own account with a Connector.

Use a key instead

A machine without a browser, or a workflow that should not act as a person, uses a key:

claude mcp add --transport http mission-control https://gateway.example.test/mcp \
  --header "Authorization: Bearer mck_example_not_a_real_key"

Issue an ordinary user or service-account key under Access → Virtual keys. Current Team allowance and key operation/resource policy determine access. No Agent key exists.

Revoke

  • Your connections are listed under Virtual keys with the client name, the Team and when they were last used. Revoke ends one immediately; Claude Code's next request is challenged again.
  • A revoked or rotated key fails on its next use in the same way.

Verification and failure recovery

Verify the server is connected in /mcp, inspect discovered tool schemas, and use a safe read-only tool. If the client cannot negotiate 2026-07-28, use the tested MCP TypeScript client or update to a compatible client; Mission Control does not provide a legacy initialize fallback. For repeated sign-in prompts, stale registration, empty Team choices, or revocation, follow Connect an AI client.

Limits

  • Consent requires an eligible Team and explicit per-tool selection for a dedicated virtual key. Nothing is selected by default; future Team additions are not automatically included.
  • Mission Control Action approvals apply to MCP calls from Claude Code too. An approval_required in-band result means nothing ran: open the returned approval link, have an authorized Team administrator approve, then repeat the identical tool and arguments. Claude Code's own permission prompt is separate and cannot bypass this requirement. See Approvals.
  • Claude Code needs the Console reachable from your browser and the gateway reachable from your machine. A custom redirect scheme is not involved: Claude Code returns to a loopback address.
  • Only MCP revision 2026-07-28 is served. A Claude Code version that speaks an older revision cannot connect.