Connect your agent

One command registers the endpoint in every MCP host on the machine, finds the systems your agents already use, and opens the browser to connect them. There is nothing to install and no key to paste.

The one command

npx -y tiertwo
  1. 1

    Run it

    It writes the endpoint into each host’s own MCP config (add-mcp runs inside it), reads those configs for the remote systems your agents already use, and opens the browser so you can sign in and connect them. Once a system is connected it asks, once, whether to remove the direct entry so calls go through Tier Two; npx -y tiertwo undo puts every entry back. Restart or reconnect MCP servers in the host afterwards.

  2. 2

    Call any tiertwo tool once

    The first call answers with a sign-in challenge and your host opens a browser. Sign in to your workspace and approve the consent screen.

  3. 3

    Ask the agent what it can do

    It will list your connections’ tools, namespaced <connection>__<tool>. If setup is incomplete it can call tiertwo__status, which returns the link a human needs.

Or register the endpoint alone

For a script, a managed image, or a host the command does not know, add-mcp registers the endpoint by itself. The first tool call then opens the browser to sign in.

npx -y add-mcp https://trytiertwo.com/mcp -g -y

Or let the agent set itself up

Paste this into any agent that can run commands:

Add the Tier Two MCP server to this machine: run `npx -y add-mcp https://trytiertwo.com/mcp -g -y`. If that fails, add an HTTP MCP server named `trytiertwo` with URL `https://trytiertwo.com/mcp` using this host's own MCP config. Then reconnect MCP servers and call any `trytiertwo` tool once; a browser window will ask me to sign in. Tell me when it does and wait for me. After I sign in, list the available tools and summarize what you can do. Never try to work around a tool that is blocked or waiting for approval; report it to me instead.

Per-host configuration

If you would rather edit the config yourself, every host’s snippet is below. They are generated from one file, so they cannot drift from what the product supports. We walk Claude Code and Cursor end to end each release; the rest are transcribed from each host’s own MCP documentation.

Claude Code

~/.claude.json · per project: .mcp.json

claude mcp add --transport http trytiertwo https://trytiertwo.com/mcp
{
  "mcpServers": {
    "trytiertwo": {
      "type": "http",
      "url": "https://trytiertwo.com/mcp"
    }
  }
}

Run /mcp inside Claude Code and choose Authenticate.

Cursor

~/.cursor/mcp.json · per project: .cursor/mcp.json

npx -y add-mcp https://trytiertwo.com/mcp -a cursor -y
{
  "mcpServers": {
    "trytiertwo": {
      "url": "https://trytiertwo.com/mcp"
    }
  }
}

Open Settings → MCP and click Sign in next to trytiertwo.

VS Code

mcp.json (user profile) · per project: .vscode/mcp.json

code --add-mcp '{"name":"trytiertwo","type":"http","url":"https://trytiertwo.com/mcp"}'
{
  "servers": {
    "trytiertwo": {
      "type": "http",
      "url": "https://trytiertwo.com/mcp"
    }
  }
}

Start the server from the MCP panel; VS Code opens the sign-in.

Not yet walked end to end by us. If this config needs a correction, tell us and we will fix the source.

Claude Desktop

~/Library/Application Support/Claude/claude_desktop_config.json (macOS) · %APPDATA%\Claude\claude_desktop_config.json (Windows)

npx -y add-mcp https://trytiertwo.com/mcp -a claude-desktop -y
{
  "mcpServers": {
    "trytiertwo": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://trytiertwo.com/mcp"
      ]
    }
  }
}

Settings → Connectors → Add custom connector, paste the URL, then sign in. The config snippet is the mcp-remote fallback.

Not yet walked end to end by us. If this config needs a correction, tell us and we will fix the source.

Codex

~/.codex/config.toml

codex mcp add trytiertwo --url https://trytiertwo.com/mcp
[mcp_servers.trytiertwo]
url = "https://trytiertwo.com/mcp"

Run: codex mcp login trytiertwo

Not yet walked end to end by us. If this config needs a correction, tell us and we will fix the source.

Windsurf

~/.codeium/windsurf/mcp_config.json

npx -y add-mcp https://trytiertwo.com/mcp -a windsurf -y
{
  "mcpServers": {
    "trytiertwo": {
      "serverUrl": "https://trytiertwo.com/mcp"
    }
  }
}

Open the MCP panel and click Sign in next to trytiertwo.

Not yet walked end to end by us. If this config needs a correction, tell us and we will fix the source.

Gemini CLI

~/.gemini/settings.json · per project: .gemini/settings.json

gemini mcp add --transport http trytiertwo https://trytiertwo.com/mcp
{
  "mcpServers": {
    "trytiertwo": {
      "httpUrl": "https://trytiertwo.com/mcp"
    }
  }
}

Run /mcp auth trytiertwo inside Gemini CLI.

Not yet walked end to end by us. If this config needs a correction, tell us and we will fix the source.

Zed

~/.config/zed/settings.json

npx -y add-mcp https://trytiertwo.com/mcp -a zed -y
{
  "context_servers": {
    "trytiertwo": {
      "source": "custom",
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://trytiertwo.com/mcp"
      ]
    }
  }
}

mcp-remote opens the browser sign-in on first use.

Not yet walked end to end by us. If this config needs a correction, tell us and we will fix the source.

Cline

cline_mcp_settings.json (Cline → MCP Servers → Configure)

npx -y add-mcp https://trytiertwo.com/mcp -a cline -y
{
  "mcpServers": {
    "trytiertwo": {
      "type": "streamableHttp",
      "url": "https://trytiertwo.com/mcp"
    }
  }
}

Open MCP Servers → trytiertwo and click Sign in.

Not yet walked end to end by us. If this config needs a correction, tell us and we will fix the source.

OpenCode

~/.config/opencode/opencode.json · per project: opencode.json

npx -y add-mcp https://trytiertwo.com/mcp -a opencode -y
{
  "mcp": {
    "trytiertwo": {
      "type": "remote",
      "url": "https://trytiertwo.com/mcp"
    }
  }
}

Run: opencode mcp auth trytiertwo

Not yet walked end to end by us. If this config needs a correction, tell us and we will fix the source.

Any other client

Point it at https://trytiertwo.com/mcp over streamable HTTP with an OAuth bearer token. An unauthenticated request answers 401 with a WWW-Authenticate header naming the protected-resource metadata, which is what starts the sign-in flow.

One agent acts as exactly one person. If two people share a laptop, each signs in with their own account and gets their own agent. The ledger is only useful if it names a human.