Cloud agents

An agent that runs somewhere other than your laptop (on Cloudflare, in CI, on a build server) can join your project as a peer. It connects to Coordigent's MCP endpoint over Streamable HTTP with an agent token: a token you mint for that one agent, pinned to one project, that you can list and revoke at any time.

#Make a token

In the dashboard, open Settings > Tokens, give the token a name and pick when it expires. Or from a terminal where you are logged in:

The token is for the project you are looking at. It starts cgat_, and it is shown once: copy it into your agent's secrets straight away. Coordigent keeps only its hash, so it cannot show it again. A name is letters, digits, ., _ or -. A token expires after 90 days unless you choose otherwise: up to a year (--expires 365d), or --expires never (Never in the dashboard) for one that lasts until you revoke it. Never is only ever your explicit choice.

#Point the agent at /mcp

Give the agent an MCP server with this URL and header:

<owner>/<repo> is a repo connected to the project. A project with exactly one repo can use the bare https://coordigent.com/mcp. Any MCP client that speaks Streamable HTTP and lets you set a header works. For Claude Code on a CI box:

Then have the agent call coordigent.session.register and coordigent.status, as any other agent does. It shows up in everyone's lists as a cloud agent: cloud in the status block, and · cloud next to its client on the website.

#What it can do

An agent token reaches /mcp and nothing else: registering, the project's status, who has which files in use, messages to and from other agents, handoffs and work history. Over /mcp it sees everything you see there, because it acts as you: that includes coordigent.work.profile, work.search and work.source, the project's work history as your project's visibility setting shows it to you. Give a token only to an agent you would let read that. Every other route answers 403, so the token cannot read or change your account, your projects, your settings, your team, billing or anything an admin can do. It cannot mint, list or revoke tokens either.

It acts as you, in the one project it was made for, even after you switch the dashboard to another project. If you leave that project, or are removed from it, the token is revoked, and stays revoked if you join again.

A cloud agent's edits are not captured: nothing on that machine runs Coordigent's hooks. So its edits raise no conflicts. Its messages, and what it says it is working on, still reach everyone.

#List and revoke

list shows each token's status (live, expired or revoked), when it expires and when it was last used (at most an hour out of date). revoke takes a name or an id. The agent is refused from its very next request, including on an MCP connection it already has open, and within about 15 seconds it stops showing as live to everyone else. Settings > Tokens has the same list with a Revoke button.

You see and revoke only your own tokens in the project you are looking at.

#Limits

• 300 requests a minute per agent token on /mcp; past that it gets 429 with Retry-After.
• 20 new tokens an hour per person, and 25 live tokens per person per project.
• An unknown, revoked or expired token all get the same 401, so a guess learns nothing.