Agent Access Client Recipes

Agent Access lets an MCP client connect to the active Sweet Tea Studio runtime for your account. The normal cloud bridge URL is:

https://sweettea.co/mcp/connectors/default

Use that URL when the client supports remote Streamable HTTP MCP. Studio chooses the currently active online runtime for the signed-in account. If you start Studio on a different machine and activate cloud bridge there, the stable connector targets that runtime.

Two Authentication Paths

Sweet Tea supports both paths because MCP clients are not consistent yet.

Use OAuth when the client has a connector UI or native MCP OAuth support. The client discovers Sweet Tea's OAuth endpoints from the MCP challenge and opens a browser sign-in. This path is intended for hosted connector surfaces like ChatGPT, Claude, and Grok, plus clients that implement MCP dynamic client registration.

Bearer token

Use a bearer token when the client cannot complete OAuth or is running in a remote shell without a usable browser callback.

{
  "Authorization": "Bearer sts_..."
}

Create or rotate the token from Studio's Agent Access settings. Treat it like a password. Rotating the token invalidates old saved client configs.

Hosted Connector Clients

Use the stable URL:

https://sweettea.co/mcp/connectors/default

Known hosted OAuth callbacks are allowlisted for ChatGPT, Claude, Grok, Cursor cloud agents, VS Code web redirect, and Google Antigravity. If a new hosted client reports invalid_redirect_uri, copy the exact redirect URI from the error and add it through the relay allowlist configuration.

Grok

Use the stable connector URL as the MCP server URL:

https://sweettea.co/mcp/connectors/default

If Grok asks for static OAuth credentials instead of discovering them automatically:

Field	Value
Client ID	`sweet-tea-grok`
Client Secret	leave blank
Authorization Endpoint	`https://sweettea.co/oauth/authorize`
Token Endpoint	`https://sweettea.co/oauth/token`
Scopes	`mcp:tools`
Token Auth Method	`none` or public PKCE client

Grok's hosted callback is allowlisted as https://grok.com/connectors-oauth-exchange-code/.

Local and IDE Clients

Local clients usually use a loopback OAuth callback such as:

http://localhost:7777/oauth/callback
http://127.0.0.1:19876/mcp/oauth/callback
http://127.0.0.1:33418

Sweet Tea allows HTTP loopback redirect URIs for local native clients. HTTPS is still required for public non-loopback callbacks.

OpenCode

OAuth-capable configuration:

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "sweettea": {
      "type": "remote",
      "url": "https://sweettea.co/mcp/connectors/default"
    }
  }
}

Bearer-token fallback:

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "sweettea": {
      "type": "remote",
      "url": "https://sweettea.co/mcp/connectors/default",
      "headers": {
        "Authorization": "Bearer sts_..."
      }
    }
  }
}

Qwen Code

OAuth-capable configuration:

qwen mcp add --scope user --transport http sweettea https://sweettea.co/mcp/connectors/default

Bearer-token fallback:

qwen mcp add --scope user --transport http sweettea https://sweettea.co/mcp/connectors/default \
  --header "Authorization: Bearer sts_..."

Gemini CLI and Gemini Code Assist

Use a lowercase server name and Streamable HTTP. Bearer-token setup is the most predictable path for remote shells:

{
  "mcpServers": {
    "sweettea": {
      "httpUrl": "https://sweettea.co/mcp/connectors/default",
      "headers": {
        "Authorization": "Bearer sts_..."
      },
      "timeout": 60000
    }
  }
}

If using OAuth, make sure the machine running the client can receive the loopback callback. Remote SSH, container, and cloud IDE sessions often need bearer-token setup instead.

Cline, Windsurf, Cursor, and Roo-style VS Code clients

Prefer Streamable HTTP when the client supports it:

{
  "mcpServers": {
    "sweettea": {
      "type": "streamable-http",
      "url": "https://sweettea.co/mcp/connectors/default",
      "headers": {
        "Authorization": "Bearer sts_..."
      },
      "disabled": false
    }
  }
}

If the client asks for url instead of httpUrl, use the same Sweet Tea URL. If OAuth does not open a browser or does not return to the app, use the bearer-token header path.

Troubleshooting

Symptom	Likely cause	Fix
`invalid_redirect_uri`	The client uses a hosted callback Sweet Tea has not seen yet	Add the exact redirect URI to the relay allowlist
`Unauthorized`	Missing, expired, or revoked token	Reconnect OAuth or rotate the Agent Access token
`No Studio runtime is online`	No active Studio instance is polling the bridge	Open Studio on the target machine and activate cloud bridge
Tool calls time out	Studio is offline or the GPU instance stopped responding	Check the Studio instance and reconnect cloud bridge
OAuth opens on the wrong machine	Client is running over SSH or in a container	Use bearer-token headers or forward the callback port

Back to Web Library, My Desk, Devices, and Tokens