Add Brain Scanner through your agent's MCP settings, approve the access you want, and let the agent handle OAuth securely. For the hosted connector, no local Brain Scanner runtime or manually pasted API key or token is required. Your agent manages OAuth. Agents with a connector interface finish entirely in the browser; command-line agents complete one short terminal login.
Open your agent's connector or MCP settings, add a remote Streamable HTTP MCP connection, name it Brain Scanner, and paste the endpoint below. Your agent follows Brain Scanner's OAuth discovery metadata and owns its callback securely.
Find Tools, Integrations, Connectors, or MCP. Labels and availability vary by agent.
2
Add remote MCP
Choose Streamable HTTP and paste the fixed Brain Scanner endpoint.
3
Authorize in browser
Let the agent start OAuth, then review the exact Brain Scanner permission.
Command-line agents: register the endpoint with your agent's own MCP command, then start its authorization command from an interactive terminal. That login needs a real terminal session and stops immediately if input is not attached to one. On the same device, approving in your browser returns to the waiting agent automatically; do not copy a URL. Only when the browser and initiating terminal are on different devices, and that terminal shows a dedicated prompt for the redirect address, treat the full address as a one-time secret: copy it from the browser address bar and paste it exactly once into that prompt. Never paste it into an arbitrary shell command, chat, issue, or support message, and do not submit the consent form again. An agent session started before you authorized keeps its unauthenticated state until you open a new one after the client confirms completion.
Compatibility: Your agent must support remote Streamable HTTP MCP, RFC 9728 protected-resource discovery, browser authorization, PKCE with S256, and the registration method advertised by Brain Scanner.
Permission boundary
What a connected agent can do.
Every agent receives the same fixed authorization profile. The Brain Scanner server enforces what each tool call may do, and hosted metadata writes are versioned and auditable.
Single profile
One fixed authorization profile
Every connected agent is issued the same scope set. The Brain Scanner server authorizes account-scoped project tools and versioned metadata writes. This hosted grant does not grant access to your filesystem or shell, or change permissions your agent already has locally.
The connector owns its callback, state, and PKCE verification.
2
Brain Scanner signs you in
Continue with the approved private-beta account.
3
You review consent
Allow only the exact permission displayed by Brain Scanner.
Connection not starting?
Add https://brainscanner.dev/mcp/v2 as a remote Streamable HTTP MCP connector. The agent must follow the advertised OAuth discovery metadata and open Brain Scanner consent in a browser. Website sign-in alone creates no connector grant. Never paste access tokens or authorization codes into chat, terminal commands, settings, or support.
If authorization was interrupted after you approved, return to the initiating client's dedicated authorization prompt. A repeated delivery for the same still-pending attempt returns only that attempt's original one-time result; Brain Scanner never creates a second code for a duplicate consent submission.
An interrupted attempt can also leave an empty grant stored on your side, which looks connected while every tool call stays unauthorized. Clear the stored credential in your agent, then add the connector and authorize again.
Changing permissions? Disconnect Brain Scanner in your agent, connect it again, and review the new Brain Scanner consent. Permission changes are never silent.
Hosted permissions and local access
Know where the work runs.
The hosted connector manages project records and requests for work. Your connected agent and enabled local Brain Scanner tools can read source files, inspect repositories, open an editor, and run supported local actions such as selected tests. Broader edits, shell commands, and repository operations depend on permissions you give your agent.
Local programs and test code may access files, environment variables, credential helpers, or credentials available to their process. A hosted connector scope is not a local sandbox. Repository and cloud-provider credentials must not be submitted as project metadata; Brain Scanner sign-in and connector credentials are handled separately.
A separate repository-source integration, if offered, requires its own repository authorization and data-collection notice. Ordinary MCP authorization does not enable it.
A compatible agent opens the OAuth request. Brain Scanner validates the approved account and enforces the granted permission on every tool call. Brain Scanner exposes project-intelligence tools and returns data; the agent decides how to use them under its own policies and permissions.
