FAQ

The same answers the home page gives, in one place. If something here is out of date, it is a bug. The list lives in one file.

Which agents does this work with?
Anything that speaks MCP over HTTP. One command (npx -y tiertwo) registers the endpoint in every host add-mcp knows: Claude Code, Cursor, VS Code, Claude Desktop, Codex, Windsurf, Gemini CLI, Zed, Cline, OpenCode. We have walked the whole flow end to end in Claude Code and Cursor; for the others we publish each host's own documented config from the same source file. Any other MCP client can point at the URL directly.
Do I need to install anything?
No. Tier Two is a hosted MCP endpoint. One command registers it in your hosts, finds the systems your agents already use, and opens the browser to sign in. Nothing runs on your machine afterwards, and there is no key to paste. The Tier Two Client is an optional download for teams that want managed devices.
What happens when a tool is set to Ask?
The call pauses. An admin sees the person, the agent, the tool and its arguments in Approvals and picks Approve once or Always for that person. The paused call then completes on its own. The agent does not have to ask again. If it is denied, the agent is told to report the refusal rather than route around it.
What does it cost?
Free includes up to 3 people and 3 connections. Team is $30 per person per month, billed for every accepted member. Enterprise is available under an annual agreement. See /pricing for the full comparison.
Where do credentials for our systems live?
In an encrypted vault on the server. When a connection uses one shared workspace key, calls are forwarded server-side: the key is decrypted in process for that call and never reaches a laptop. When each person signs in with their own account, the token is brokered per person and revocable, and downstream permissions stay exactly theirs.
Can we stream the audit trail to our SIEM?
Yes, today. Both ledgers export to a destination you configure: an HMAC-signed webhook you verify like a Stripe signature, or Splunk HEC. Three versioned streams (decisions, governance changes, sessions) arrive in order, at least once, on a five-minute cadence. Test-send and secret rotation are built in.
Can people sign in with our identity provider?
Human sign-in runs on Clerk. If your org signs in through Okta, Entra, or Google Workspace, talk to us and we will configure your workspace for it.
Do you provision people from our directory?
Not yet. Directory sync (SCIM) is on the roadmap, not shipped. Today membership and roles are managed in Tier Two, and human sign-in already supports your identity provider at the auth layer.