Connect Claude Code (MCP)
Neens exposes a Model Context Protocol (MCP) server so Claude Code can read your failure→fix loop and write back to it with tools instead of hand-written HTTP calls. The secure, recommended way to connect is a per-user browser sign-in: you run one command, Claude Code opens a browser to sign in to Neens, you pick an agent, and Claude Code is then authorized as you — not as the bearer of a shared key. Every tool call it makes is attributable to your account and governed by your role.
At a glance
| Command | claude mcp add --transport http neens <your-neens-url>/mcp |
| How you sign in | A browser window to Neens (which may itself be SSO) |
| What you’re authorized as | You — your account, your role, on the agent you pick |
| Manage authorizations | Settings → MCP access — view and revoke every connection |
| No shared secret | Nothing to paste, nothing to store; the authorization is bound to you |
This replaces pasting a shared nk_live_ agent key into the client. A key names an agent but no
person; the OAuth sign-in binds the connection to you, so what Claude Code can do is exactly
what you can do in that agent, and you can revoke it at any time. The
agent-key method still works for headless automation that has no human to
sign in.
Connect
Add the Neens MCP server
Run this in your terminal, substituting your Neens URL:
claude mcp add --transport http neens https://YOUR_NEENS_HOST/mcpNote there is no --header and no key — the whole point is that you authorize interactively.
Sign in through your browser
The first time Claude Code uses the server it opens a browser window to sign in to Neens. Sign in the way you normally do — with your email and password, or Continue with SSO if your company uses single sign-on. If your company federates login, you sign in through your own identity provider and never enter a separate Neens password — see Sign in with your company’s single sign-on.
Pick an agent and approve
Neens shows a short consent screen: Authorize Claude Code to act as you, with a picker for which of your agents to scope this connection to. Choose the agent and click Allow. The browser hands control back to Claude Code, which is now connected.
Verify
Start a session and ask Claude Code to list the Neens tools. You should see the Neens MCP tools
appear, namespaced as mcp__neens__…. Seeing none means the authorization didn’t complete — re-run
the sign-in.
The authorization is scoped to the one agent you picked, exactly like an agent key — Claude
Code can read and write within that agent and nothing else, and it can never delete. To work in a
different agent, add a second connection (give it a different server name, e.g. neens-staging)
and pick that agent during its sign-in.
Sign in with your company’s single sign-on
If your company routes its email domains to an identity provider — Okta, Azure AD / Microsoft Entra, Google Workspace, or any SSO connection — connecting Claude Code uses that same login. There is no separate Neens password to create or remember.
Run the same command
claude mcp add --transport http neens https://YOUR_NEENS_HOST/mcpNothing changes on the command line — federation is decided by your email domain, not by a flag you pass here.
Sign in through your own identity provider
Claude Code opens the browser and Neens recognizes your company by your work email. Instead of a Neens password prompt you go straight to your identity provider and sign in there exactly as you do for every other company app — including whatever MFA your IdP enforces. If your company also requires a Neens second factor on top of the IdP, you enter that code before you continue.
Approve and pick an agent
Your IdP returns you to Neens, which shows the same consent screen — Authorize Claude Code to act as you, with the agent picker — and you click Allow. Claude Code is now connected as you.
Neens brokers the connection; it never holds your IdP credentials. Your identity provider authenticates you, and Neens then issues Claude Code its own short-lived access token bound to you, your role, and the one agent you picked. Claude Code never receives a token from your IdP, and your IdP never sees Claude Code — you get an ordinary Neens authorization that your role governs and that you can revoke, established through a login you already trust.
Staying connected
Your authorization is time-limited, but Claude Code refreshes it for you — you do not have to sign in again every hour. Under the hood the access token is short-lived and Claude Code silently renews it in the background with a longer-lived refresh token, so a working connection keeps working across a day of use with no interruption.
Eventually the refresh window itself ends (or you revoke the connection, or an admin removes your access). When that happens Claude Code reports something like your session expired, sign in again on its next tool call. That is expected and harmless — re-run the sign-in and Claude Code reconnects:
claude mcp add --transport http neens https://YOUR_NEENS_HOST/mcpNothing you do keeps a token alive past its limits — that is deliberate. A connection that could never expire would be a standing key; a bounded one that quietly refreshes while you work, and asks you to sign in again when the window closes, is what keeps every action attributable to a live login.
What Claude Code can do over MCP
Once connected, Claude Code drives the same MCP tools any MCP client gets — read your traces, failure modes and clusters, curate datasets, stand up judges, run pre-prod evaluations, move remediations forward, and close the fix loop by verifying a fix against your preview deploy. The difference is only in who it acts as: every one of those actions is attributable to you and admitted by your role, the same as if you’d done it in the app. Reads are open to your credential; the writes it may perform are the same non-destructive ones the MCP server guide lists, and no tool deletes anything.
Manage your MCP authorizations
Every connection you approve is listed under Settings → MCP access as an active MCP connection, showing the client, the agent it’s scoped to, and when it was created, last used, and expires.
- Revoke any connection to disconnect that Claude Code session immediately — the next tool call it attempts is rejected and it will have to sign in again to reconnect.
- The list is yours: it shows your own authorizations only, and revoking one never affects another person’s connections.
- Authorizations are time-limited and drop off the list once they expire; revoking is the way to end one early.
Revoke a connection you no longer recognize the same way you’d revoke any credential. Because the authorization is bound to your account, a revoke is complete — there is no shared key still floating around that would keep working.
Related
- MCP server — the full tool catalogue, the fix loop over MCP, and the agent-key connection method for headless use.
- Single sign-on (SSO) — the browser sign-in this flow uses when your company federates login to an IdP.
- Assistant — the same tools, in-app, over a chat interface.
- API keys — agent keys for scripts and CI that have no human to sign in.