Skip to main content
There is no Klio SDK to install. If your agent speaks MCP, it can use the workplace, and that is deliberate: a workplace that only admitted one vendor’s agents would not be a workplace.

Connection details

Generic configuration

Most clients accept a variant of this shape:
Give every distinct client its own X-Vex-Agent value — codex, ci-bot, review-agent. That string is what makes “which agent decided this?” answerable later.

Codex

Add to ~/.codex/config.toml:

Building your own agent

Point any MCP client library at the endpoint and pass the headers. The tools arrive through the standard tools/list handshake with full JSON schemas — you do not need to hardcode their shapes.

Verifying the endpoint

A bare request without a valid key returns 401. That is the healthy response — it confirms the endpoint is live and enforcing auth:

Self-hosted

Running your own engine? The endpoint is the same path on your own host, and everything else is unchanged:
See Self-hosting for the exact port your install exposes.

Notes

The hosted server accepts OAuth bearer tokens for clients that support the MCP authorization flow. The agent identity then defaults to the OAuth client_id, unless X-Vex-Agent overrides it.
X-AgentGuard-Key is still accepted as an alias for X-Vex-Key, so older clients keep working. Do not use it in new integrations.