@briefgate/mcp

Stop your coding agent stalling on client logos, copy and credentials.

Watch as MP4 (47 s)

BriefGate is the first client intake tool built for AI agents. Your agent declares what it needs (define_intake), BriefGate generates a branded portal and chases the client automatically with email reminders, and your agent retrieves fully typed assets (get_intake_results) and keeps building.

Agent: define_intake(items=[logo, copy, wp_admin])
BriefGate: → sends invite email → chases client every few days
Client:    fills in the portal (mobile-friendly, no login required)
Agent: get_intake_results() → { logo: "https://signed-url/logo.svg", wp_admin: "s3cr3t" }
Agent: keeps building the website ✅

Quickstart — Claude Code

Option 1 — sign in, nothing to copy:

claude mcp add briefgate -- npx -y @briefgate/mcp
npx -y @briefgate/mcp login

login prints a short code and a URL, tries to open your browser to it, and waits (up to 10 minutes) for you to click Allow. On success it prints Signed in as <account> and exits; the key lands in ~/.briefgate/credentials.json (mode 0600) and the server picks it up automatically — no restart, nothing to paste into config. npx -y @briefgate/mcp logout removes it again and best-effort revokes it on the server too.

Prefer to sign in from inside the agent instead of a terminal? Skip the login command above and just ask Claude Code to "call the briefgate login tool" instead — same flow, one call at a time. See Sign in without an API key.

Prefer connecting straight to the hosted endpoint instead of running the package locally? claude mcp add --transport http briefgate https://mcp.briefgate.dev/mcp walks you through OAuth in the browser — see Hosted endpoint + OAuth below.

Option 2 — paste an API key (for CI, scripts, or if you'd rather manage the key yourself). Get one at briefgate.dev (free tier available, no card required):

claude mcp add briefgate \
  -e BRIEFGATE_API_KEY=bg_live_... \
  -- npx -y @briefgate/mcp

Or add manually to ~/.claude/settings.json:

{
  "mcpServers": {
    "briefgate": {
      "command": "npx",
      "args": ["-y", "@briefgate/mcp"],
      "env": {
        "BRIEFGATE_API_KEY": "bg_live_..."
      }
    }
  }
}

BRIEFGATE_API_KEY (or --api-key on the command line), if set, always takes precedence over a key login stored locally — running login while one is configured just says so instead of doing anything.

Verify it loaded — run /mcp in Claude Code and look for briefgate with 15 tools.

Quickstart — Cursor / Codex / other MCP clients

login / logout work the same way for any client that runs the package locally: register it with no key at all, then either run npx -y @briefgate/mcp login yourself or ask the agent to call the login tool.

{
  "mcpServers": {
    "briefgate": {
      "command": "npx",
      "args": ["-y", "@briefgate/mcp"]
    }
  }
}

Or paste an API key instead, add to your MCP config (usually .cursor/mcp.json or similar):

{
  "mcpServers": {
    "briefgate": {
      "command": "npx",
      "args": ["-y", "@briefgate/mcp"],
      "env": {
        "BRIEFGATE_API_KEY": "bg_live_..."
      }
    }
  }
}

Sign in without an API key

Two ways to get a key onto this machine without pasting one — both run the same device-authorization flow (RFC 8628) against the same credential file, so pick whichever fits how you're using the package.

From a terminal — the login / logout subcommands:

npx -y @briefgate/mcp login     # prints a code + URL, waits for approval, saves the key
npx -y @briefgate/mcp logout    # removes the local key, best-effort revokes it remotely

login blocks until you approve it (or it times out at 10 minutes), then prints Signed in as <account_name> and exits 0 — or prints why it didn't work (denied, expired, an error) and exits 1. logout always removes the local copy; it also sends DELETE /v1/keys/current using that same key to revoke it server-side, and if that call fails (no network, API unreachable) it says so and points at the BriefGate dashboard instead of leaving you unsure whether the key is still live.

From an agent — the login / logout tools (see Tools):

Same flow, for a client that can't block a terminal on your click. login is two-phase because a tool call can't sit open for minutes:

1. The first call starts the flow and returns immediately with the code and URL. A browser is opened automatically where possible.
2. Call login again — any time, or once you've approved it — to check progress. While it's still waiting, it says so; once approved, that same call reports success and the key is saved. No restart needed: the very next tool call is signed in.

logout as a tool does exactly what the subcommand does, including the best-effort remote revoke.

Either way, the key lands in ~/.briefgate/credentials.json (directory mode 0700, file mode 0600; override the path with BRIEFGATE_CREDENTIALS_FILE), keyed by which BriefGate server it's for so a staging BRIEFGATE_BASE_URL and production never collide. An explicit key always wins over a stored one — --api-key, then BRIEFGATE_API_KEY, then whatever login last saved — and login says so instead of running the flow when one of those is already set. Neither the subcommands nor the tools apply to the shared hosted endpoint (mcp.briefgate.dev) — see Hosted endpoint + OAuth, where connecting a client triggers real OAuth instead.

Environment variables

--api-key bg_live_... is also accepted on the command line, ahead of BRIEFGATE_API_KEY in priority. login and logout are also accepted as the first command-line argument (npx @briefgate/mcp login), instead of --http/no flag.

HTTP (Streamable HTTP) mode

For remote or multi-session deployments, start the server in HTTP mode:

BRIEFGATE_API_KEY=bg_live_... npx @briefgate/mcp --http --port 3000

The server binds to 127.0.0.1 only and includes DNS-rebinding protection. Behind a reverse proxy, terminate TLS there and forward to the local port — do not expose the port directly.

Hosted endpoint + OAuth

Set BRIEFGATE_MCP_PUBLIC_HOST to the hostname the server is published under and it becomes a shared, multi-customer endpoint: each caller sends its own key as Authorization: Bearer bg_live_... (an OAuth access token, for this API, is that same key — see below), and the server speaks to the BriefGate API as that caller. The public instance is https://mcp.briefgate.dev/mcp.

BRIEFGATE_MCP_PUBLIC_HOST=mcp.example.com npx @briefgate/mcp --http --port 3000

Several things change, on purpose: