MCP servers
An MCP server is defined either for a whole workspace (by workspace admins) and then attached to agents, or for one agent only (by that agent’s admins).
- Remote (HTTP): a URL and optional headers.
- Local (stdio): a command, arguments and environment. The command runs inside the agent’s sandbox, so it
must exist there (for example
npx, which the base image has).
Servers reach the harness through ACP: the mcpServers of session/new, session/load and session/resume.
This works the same for every harness. Remote servers are left out for harnesses that do not support HTTP MCP.
Changes take effect in the agent’s next session.
Authentication through the proxy
Header, environment, argument and URL values may reference a workspace secret as {{secret:NAME}}. The sandbox
only gets the secret’s placeholder. The egress proxy injects the secret for the hosts in its rule, both by setting
the rule’s header and by replacing the placeholder wherever it appears. For example, a remote MCP server at
mcp.example.com with the header Authorization: Bearer {{secret:example-token}} works when the
example-token secret’s rule lists mcp.example.com. A secret referenced this way is injected for the agent even
if it is not attached to the agent. Only users who can manage a secret (its owner and workspace admins) can
reference it.
Skills
The workspace skills library holds Agent Skills: a name, a description of when to use it,
and Markdown instructions. Attached skills are written into the agent’s sandbox as <dir>/<name>/SKILL.md, in the
directory its harness reads:
| Harness | Skills directory |
|---|---|
| Claude Code | ~/.claude/skills |
| OpenCode | ~/.config/opencode/skills |
| Codex | ~/.codex/skills |
They are written whenever a session starts, so changes apply to the next session. Skills that agenthold installed and that are no longer attached are removed. Skills the agent created itself in the same directory are left alone.
The end-to-end check runs against the dev stack: scripts/e2e/tools.sh (OpenCode with a real model; set
HARNESS=claude-code once that harness is signed in).