Skip to main content
One server URL connects every client:
OAuth-capable clients need nothing else - add the URL and complete the browser sign-in. Clients without OAuth send an API key in the Authorization header instead. Pick your client below.

Client setup

Run this command in your terminal to add the AGI devices MCP server:
Then open Claude Code, run /mcp, select agi-devices, and complete the browser sign-in. Verify the connection:
Claude Code stores and refreshes the OAuth credentials. Use Clear authentication from /mcp if you need to sign in with another AGI account.

Authentication

The server supports two authentication methods. OAuth is recommended for every client that supports remote MCP authorization; API keys remain available for clients that cannot complete a browser sign-in. The server implements the MCP authorization specification, which is built on OAuth 2.1:
  • Authorization code flow with PKCE (S256): the only supported grant, alongside refresh tokens. No client secret is required for public clients.
  • Automatic discovery: an unauthenticated request returns a 401 with a WWW-Authenticate challenge pointing at the server’s protected resource metadata (RFC 9728), which names the authorization server. Clients fetch the authorization server metadata (RFC 8414) from there.
  • Dynamic client registration (RFC 7591): compatible clients register themselves automatically; there is nothing to pre-configure.
  • Scope: the server requires the email scope. Grants missing it fail with insufficient_scope.
  • Token lifecycle: clients store and refresh access tokens automatically. Revoke a grant by clearing the connection’s saved authentication in your client, or via the authorization server’s revocation endpoint.
In practice: add https://api.agi.tech/v1/mcp to an OAuth-capable client with no token or custom header, and the client walks the whole flow (discovery, registration, browser sign-in) on its own.
OAuth access tokens are accepted only by the MCP endpoint. They do not replace API-key or session authentication on other AGI REST APIs. Authorization is negotiated independently of the MCP protocol version: the 2024-11-05 protocol and the 2025-06-18 authorization specification work together.

API keys

If your MCP client does not support OAuth, create an API key at platform.agi.tech/me/api-keys and send it on every MCP request:
Keep your API key private. Anyone with your key can connect to and control your registered Android devices. Revoke and regenerate it immediately at platform.agi.tech/me/api-keys if it is ever exposed.

Verify the connection

After connecting, ask your assistant to list your devices - it should call list_devices and report your phone as online. Two quick checks if it doesn’t:
Sign in with the same AGI account everywhere: the Android app, the OAuth browser flow, and the dashboard where you created your API key. Account mismatches present as an empty device list, not as an auth error.

Next

Quickstart

Run your first task end to end

Tool reference

Every tool, parameter, and outcome