Prompt it.
ROOTKey does it.

Before you start: custom connectors work on Free (one custom connector), Pro, Max, Team and Enterprise. On Team, only Owners and Primary Owners add it; on Enterprise, so can someone whose custom role includes Manage access to Libraries. Members then click Connect on it. Adding from the mobile apps is in beta, so use the web or Claude Desktop.

1. Open ConnectorsOn claude.ai or in Claude Desktop, open Customize > Connectors. On Team or Enterprise, the Owner opens Organization settings > Connectors.
2. Add a custom connectorClick + Add > Add custom connector (some accounts show Add > Custom > Web). A Team or Enterprise Owner, in Organization settings > Connectors, clicks Add > Custom and chooses Web if asked. Name it ROOTKey and enter this address:https://mcp.rootkey.ai/mcpCopy
3. Choose the sign-in settingsUnder Authentication, choose Sign in now or Sign in when needed, not No sign-in. Under OAuth client, choose Use Claude's published identity (Recommended). Leave Request headers empty and click Add. These settings cannot be changed later: to change them, remove the connector and add it again. If your dialog is a single screen with Advanced settings, enter the name and address, leave Advanced settings empty and click Add.
4. Connect and sign in to ROOTKeyClick Connect and sign in to ROOTKey. On the consent screen, choose the permissions (Read, Write, Delete), Stay connected and the organisations, then Allow access. No token to create or paste.
5. Turn it on in a chatIn the message box, select + > Connectors and switch on ROOTKey. When Claude asks to use a tool, choose Allow once or Always allow. You can change tool permissions (Always allow, Needs approval, Blocked) later under Customize > Connectors > ROOTKey. On Team and Enterprise, Owners can limit them for the whole organisation, and you cannot override those limits.
6. Disconnect when doneIn ROOTKey, open Account Settings > Connected apps, open the app’s actions menu and choose Disconnect app. Then remove the connector in Claude (Customize > Connectors > ROOTKey, three-dot menu, Remove). An Owner removes an organisation connector under Organization settings > Connectors.

Steps checked against the official documentation (Claude Help Center, Claude Docs), October 2026.

Before you start: custom MCP servers are added on chatgpt.com in a web browser, not in the mobile apps. Full support, including write actions, is for Business and Enterprise/Edu, where admins and owners add them (on Enterprise/Edu, also members given the Create plugins with MCPs permission). Pro gets read and fetch tools only. OpenAI does not say whether Plus, Go or Free can add them.

1. Open PluginsOn chatgpt.com, go to Plugins, select the plus button, then Add custom MCP server. Developer Mode is not needed. Name it ROOTKey.
2. Use this addressUnder Connection, enter:https://mcp.rootkey.ai/mcpCopy
3. Choose OAuthAs authentication, choose OAuth. There is no token to paste. If ChatGPT asks how to register, choose CIMD (client ID metadata document): ROOTKey does not offer dynamic client registration.
4. Create it and sign inTick I understand and want to continue and select Create as a plugin. When ChatGPT asks you to sign in, now or at the first ROOTKey tool, sign in to ROOTKey, choose the organisations and permissions, then Allow access.
5. Install it, and publish it for a workspaceInstall the plugin. To share it in a Business or Enterprise/Edu workspace, an admin or owner publishes it in Admin Console > (workspace) > Plugins > Manage Legacy Apps > Drafts > Publish. On Enterprise/Edu, the publish dialog also has Configure Actions and Configure Access. Users then find it under Settings > Plugins.
6. Use it in a chatType @ in the prompt box and select ROOTKey. The choice covers one message, so mention it again for each request. Confirm write actions when ChatGPT asks.

Good to know. ChatGPT keeps a snapshot of the tools. After ROOTKey changes its tools, open the server in Plugins and select Refresh; an app published to a workspace needs an admin to refresh and republish it. If a ROOTKey organisation limits Allowed apps to Only these apps, ChatGPT is blocked there until an admin adds its client metadata address, expected to be https://chatgpt.com/oauth/client.json (not tested).

Steps checked against the official documentation (OpenAI Help Center), October 2026.

The Gemini app cannot connect to the hosted ROOTKey connector yet. The Gemini app and Gemini CLI sign in to servers through Dynamic Client Registration or pre-issued OAuth credentials, and ROOTKey uses client ID metadata documents. Use Gemini CLI with the local ROOTKey server, or another app such as Claude.

Before you start: since 18 June 2026, Gemini CLI and the Gemini Code Assist extensions work only with a Gemini Code Assist Standard or Enterprise licence or a paid Gemini API key, not with Google AI Pro, Ultra or the free individual tier. The local server needs Node.js 20 or later.

1. Create a personal access tokenIn the ROOTKey app, open Account Settings > Personal access tokens and choose only the scopes and organisations you need. Set it in your shell as ROOTKEY_TOKEN. Never paste the token into the chat.
2. Add the local server to Gemini CLIAdd this under mcpServers in ~/.gemini/settings.json. Gemini CLI fills in $ROOTKEY_TOKEN from your environment. Gemini Code Assist in VS Code reads the same file: run Developer: Reload Window afterwards.

   {
     "mcpServers": {
       "rootkey": {
         "command": "npx",
         "args": ["-y", "@rootkey/mcp"],
         "env": { "ROOTKEY_TOKEN": "$ROOTKEY_TOKEN" }
       }
     }
   }

   Copy
3. Check the connectionRestart gemini and run /mcp: rootkey should be listed with its tools (32, or 20 with ROOTKEY_READ_ONLY=true). Then ask it to call rootkey_get_environment_info.

Steps checked against the official documentation (Gemini CLI), October 2026.

Before you start: xAI says connectors are available to all Grok users. On Grok Business and Enterprise, a team admin adds the connector first, which needs Team Read-Write permissions.

1. Open ConnectorsSign in at grok.com and open grok.com/connectors. On Business or Enterprise, the admin first adds it for the team in console.x.ai > (your team) > Grok Business > Connectors > + Add Connector > Other.
2. Add a custom connectorClick New Connector, then Custom, and enter this address. No token, header or API key is needed:https://mcp.rootkey.ai/mcpCopy
3. Sign in to ROOTKeyComplete the sign-in Grok asks for. On the consent screen, choose the organisations and permissions, then Allow access. If it shows an Unverified app badge, continue only if you started the connection yourself from grok.com.
4. Use it in a chatAsk, for example: “List my ROOTKey organizations.” xAI documents no per-chat switch for custom connectors, so if Grok does not use ROOTKey, mention ROOTKey in the request.
5. Disconnect when doneIn the ROOTKey app, open Account Settings > Connected apps and choose Disconnect app from the app’s actions menu. Also remove the connector at grok.com/connectors if you no longer want it listed.

Not yet tested with ROOTKey. xAI does not say how Grok registers with a sign-in server, so a ROOTKey sign-in from Grok has not been confirmed. If it does not complete, use Claude or Claude Code.

curl https://api.x.ai/v1/responses \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $XAI_API_KEY" \
  -d '{
    "model": "grok-4.7",
    "input": [{"role": "user", "content": "List my ROOTKey organizations"}],
    "tools": [{
      "type": "mcp",
      "server_url": "https://mcp.rootkey.ai/mcp",
      "server_label": "rootkey",
      "authorization": "<ROOTKEY_OAUTH_ACCESS_TOKEN>"
    }]
  }'

Steps checked against the official documentation (xAI), October 2026.

1. Add a custom connectorIn your AI app’s connector or MCP settings, add a custom connector.
2. Use this addresshttps://mcp.rootkey.ai/mcpCopy
3. Connect and sign in to ROOTKeyNo token to create or paste.
4. Choose what it may doOn the consent screen, choose the organisations and the permissions the app gets.

Before you start: you need a Claude Code login (Pro, Max, Team or Enterprise, or a Claude Console account). No ROOTKey token: you sign in in the browser. In ROOTKey, if an admin set Organization Settings > AI agents > Allowed apps to Only these apps, Claude Code must be on the list (an admin can add it after you connect once).

1. Add the hosted serverIn a terminal, run this. --scope user makes it available in every project; --scope project writes .mcp.json to share it with your team, and Claude Code then asks each person to approve the server. In the VS Code extension (v2.1.261 or later) you can also type /mcp in the chat panel and add it there.claude mcp add --transport http --scope user rootkey https://mcp.rootkey.ai/mcpCopy
2. Sign inInside Claude Code, run /mcp, choose rootkey and sign in. Or run claude mcp login rootkey from the shell.
3. Approve on ROOTKeySign in to ROOTKey, choose the organisations and permissions, then Allow access. The screen notes that the app receives the result on your device: continue only if you started the connection yourself.
4. Check itRun claude mcp list: rootkey should show Connected. Then ask: “List my ROOTKey organizations.”
5. To revoke accessIn Claude Code, use Clear authentication in /mcp or run claude mcp logout rootkey, and run claude mcp remove rootkey to remove the server. In ROOTKey, open Account Settings > Connected apps and choose Disconnect app; this does not remove the server from Claude Code.

Steps checked against the official documentation (Claude Code), October 2026.

Cursor cannot sign in to the hosted ROOTKey connector yet. Cursor registers with servers through Dynamic Client Registration and does not yet support client ID metadata documents, which ROOTKey uses. Use the local server with a personal access token.

Before you start: the local server needs Node.js 20 or later. On a team account, an admin allowlist (Team Settings > MCP Configuration) can block a server that is not on it.

1. Create a personal access tokenIn the ROOTKey app, open Account Settings > Personal access tokens and choose only the scopes and organisations you need. Set it as ROOTKEY_TOKEN in the environment Cursor starts from, and never commit it.
2. Add the server to mcp.jsonAdd this to ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (this project). ${env:ROOTKEY_TOKEN} keeps the token out of the file.

   {
     "mcpServers": {
       "rootkey": {
         "command": "npx",
         "args": ["-y", "@rootkey/mcp"],
         "env": { "ROOTKEY_TOKEN": "${env:ROOTKEY_TOKEN}" }
       }
     }
   }

   Copy
3. Turn it onOpen Customize from the sidebar and check that rootkey is listed and on. If the tools do not appear, restart Cursor fully.
4. Check the connectionIn Agent chat, ask Cursor to call rootkey_get_environment_info and approve the tool call. If it fails, look in Output > MCP Logs.

Steps checked against the official documentation (Cursor), October 2026.

Before you start: use VS Code 1.106 or later (1.140 or later for the Global > Copilot Global destination in step 1). On Copilot Business or Enterprise, an admin must turn on the MCP servers in Copilot policy, which is off by default, and an admin allowlist can block ROOTKey. In ROOTKey, if an admin set Organization Settings > AI agents > Allowed apps to Only these apps, VS Code must be on the list (an admin can add it after you connect once).

1. Add the serverOpen the Command Palette and run MCP: Add Server. Choose HTTP (HTTP or Server-Sent Events), enter this address and the ID rootkey, and pick Global > Copilot Global to use it in every workspace:https://mcp.rootkey.ai/mcpCopy
2. Sign in to ROOTKeyOn the first connection VS Code opens ROOTKey in your browser. Sign in, choose the organisations and permissions, then Allow access. No token to paste. If it does not connect, run MCP: List Servers, select rootkey and use Restart or Show Output. Workspace servers (.vscode/mcp.json, .mcp.json) follow Workspace Trust and do not start in Restricted Mode. Global servers can ask you to trust them on first start; MCP: Reset Trust resets that choice.
3. Turn on the toolsIn Copilot Chat, select Agent, open Chat: Open Customizations > Tools and check that the rootkey tools are on. Then ask: “List my ROOTKey organizations.”
4. Or edit the fileIn .vscode/mcp.json or the user mcp.json (labelled deprecated in the Add Server picker, but still read), add this. The portable files (.mcp.json, ~/.copilot/mcp-config.json) use mcpServers instead of servers: do not mix the two formats.

   {
     "servers": {
       "rootkey": {
         "type": "http",
         "url": "https://mcp.rootkey.ai/mcp"
       }
     }
   }

   Copy
5. Visual Studio and JetBrainsIn Visual Studio 2026, open Agent mode > Tools > + > Add custom MCP server (on Visual Studio 2022 17.14 or later, + opens Add MCP server directly). Turn the tools on in Tools, and sign in with the Manage Authentication CodeLens in .mcp.json. Whether this sign-in works with ROOTKey is not verified. Copilot for JetBrains does not support client ID metadata documents, so the hosted sign-in will probably fail there: use the local server instead.

Steps checked against the official documentation (VS Code), October 2026.

Windsurf is now Devin Desktop, and its agent is Devin Local. The old Cascade setup (~/.codeium/windsurf/mcp_config.json) no longer applies. Devin documents sign-in only through dynamic client registration or a pre-registered client, so a sign-in to the hosted ROOTKey connector is not verified: use the local server.

Before you start: on Enterprise, an admin must first turn on Devin Local Agent, and Teams and Enterprise admins can limit MCP servers. The devin commands need the Devin CLI: use Command Palette > Install Devin CLI (on Enterprise, an admin must first turn on Install Devin CLI in Devin Desktop), or run curl -fsSL https://cli.devin.ai/install.sh | bash (macOS/Linux) or irm https://static.devin.ai/cli/setup.ps1 | iex (Windows). The local server needs Node.js 20 or later.

1. Open Devin LocalUpdate Devin Desktop. If Devin Local is missing from the agent selector, open Devin User Settings > Agents, turn it on and restart.
2. Create a personal access tokenIn the ROOTKey app, open Account Settings > Personal access tokens and choose only the scopes you need.
3. Add the local serverRun this with your token in place of <token>, then restart Devin Desktop. Keep the token out of files tracked by git.devin mcp add -s user -e ROOTKEY_TOKEN=<token> rootkey -- npx -y @rootkey/mcpCopy
4. Check and use itIn a new Devin Local tab, ask it to call rootkey_get_environment_info, then: “List my ROOTKey organizations.” By default, Devin Local asks before each tool call. You can allow one tool or the whole rootkey server, for the session or permanently.
5. To try the hosted serverFirst run devin mcp remove rootkey -s user to remove the local entry. Then add this to %APPDATA%\devin\mcp_config.json (Windows) or ~/.config/devin/mcp_config.json (macOS/Linux), or run devin mcp add -s user rootkey https://mcp.rootkey.ai/mcp, and run devin mcp login rootkey. If a registration or OAuth error appears before the ROOTKey page, run devin mcp remove rootkey -s user again and add the local server back with step 3.

   {
     "mcpServers": {
       "rootkey": {
         "url": "https://mcp.rootkey.ai/mcp",
         "transport": "http"
       }
     }
   }

   Copy

Steps checked against the official documentation (Devin), October 2026.

Before you start: use a current Codex CLI or IDE extension. OpenAI states no plan requirement for remote servers. The Codex CLI, the IDE extension and the ChatGPT desktop app share one configuration. In ROOTKey, if an admin set Organization Settings > AI agents > Allowed apps to Only these apps, Codex must be on the list. OpenAI publishes no client metadata address for Codex, so the admin adds it from the apps members have already connected, after you connect once.

1. Add the serverIn a terminal, run this. Do not pass --oauth-client-id: ROOTKey needs no pre-registered client. Or add the table below to ~/.codex/config.toml (or .codex/config.toml in a trusted project).codex mcp add rootkey --url https://mcp.rootkey.ai/mcpCopy

   [mcp_servers.rootkey]
   url = "https://mcp.rootkey.ai/mcp"

   Copy
2. Or in the IDE extensionOpen gear menu > MCP servers > Add server, name it rootkey, choose Streamable HTTP, enter https://mcp.rootkey.ai/mcp, save and select Restart extension.
3. Sign inRun codex mcp login rootkey, or select Authenticate in the IDE. Codex opens ROOTKey in your browser. Its default registration setting (auto) picks client ID metadata document registration for ROOTKey; to force it, run codex mcp login rootkey --oauth-client-registration cimd. Do not use dcr: ROOTKey has no registration endpoint.
4. Approve on ROOTKeySign in, choose the organisations and permissions, then Allow access.
5. Check itRun codex mcp list or type /mcp in Codex, then ask: “List my ROOTKey organizations.”

Steps checked against the official documentation (OpenAI Codex), October 2026.