Files
gbrain/docs/tutorials/connect-coding-agent.md
T
7b0d99adb0 v0.42.2.0 feat: gbrain connect — one-command Claude Code onboarding from a bearer token (#1683)
* fix: gbrain auth create dropped the name on the bare (no-flag) form

Extract parseAuthCreateArgs; only exclude the --takes-holders value from the
positional search when the flag is present (rest[takesIdx+1] resolved to rest[0]
when takesIdx === -1, silently dropping the name). Add regression test.

* feat: gbrain connect — one-command Claude Code onboarding from a bearer token

New connect command prints a paste-ready claude-mcp-add block (or --install wires
it + smoke-tests the token via a raw-bearer get_brain_identity probe). Direct HTTP
MCP, literal-token default, URL normalization, token header-injection guard,
--json redaction, execFileSync (no shell). Wired into CLI_ONLY + CLI_ONLY_SELF_HELP
+ handleCliOnly. 58 unit + 3 PGLite-E2E cases; e2e-test-map updated.

* docs: lead CLAUDE_CODE.md with gbrain connect (remote fast path) + README one-liner

Regenerate llms-full.txt for the README change.

* refactor: pre-landing review fixes for gbrain connect

- DRY: single DEFAULT_PROBE_TIMEOUT_MS + shared isAuthErrorMessage predicate
- reuse promptLine (shared stdin lifecycle) for the --install confirm
- harden redactToken with a Bearer <value> scrub (defense in depth)
- +8 tests: orchestrator guard paths, deterministic timeout, invalid --timeout-ms,
  Bearer-redaction

* fix: adversarial-review hardening for gbrain connect

- probe: Promise.race the call against a real timer so a stalled connect()/SSE
  handshake (signal alone doesn't cover it) can't hang --install indefinitely
- probe: close transport even if client.connect() throws
- parseArgs: reject a missing/flag-shaped value (e.g. --token --install)
- block link-local / cloud-metadata hosts (169.254/fe80:/fd00:ec2::254) — keeps
  localhost + RFC1918 LAN brains working
- non-interactive --install now requires --yes
- clearer message when --force removed then add failed
+8 tests covering each

* fix: codex-review P2s for gbrain connect

- POSIX single-quote the rendered claude-mcp-add command so a token with shell
  metacharacters ($(), backticks) can't trigger command substitution on paste
- detect IPv4-mapped IPv6 metadata addresses (::ffff:169.254.x.x / ::ffff:a9fe:*)
  so they don't bypass the link-local guard
+3 tests

* chore: bump version and changelog (v0.42.2.0)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs: document gbrain connect + connect-probe in CLAUDE.md Key files (v0.42.2.0)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat: gbrain connect — add codex and perplexity agents

--agent codex emits 'codex mcp add ... --bearer-token-env-var GBRAIN_REMOTE_TOKEN'
(token read from the env var at runtime, never in Codex config; --install runs it).
--agent perplexity prints the URL + token for the Settings → Connectors GUI (no
--install). Generalized the command file: AGENT_SPECS table, buildCodexMcpAddArgv,
cmdString(binary,argv), binary-generic ConnectDeps (hasBinary/runBinary/env),
agent-aware buildConnectBlock/buildJson. +25 tests.

* docs: codex + perplexity connect paths (new CODEX.md, README, CHANGELOG, CLAUDE.md)

Regenerate llms-full.txt for the CLAUDE.md/README edits.

* test: real-CLI E2E for connect — drive actual claude + codex against a live server

Adds claude-code + codex cases to connect-bearer.test.ts that run the real
'claude mcp add' / 'codex mcp add' through 'gbrain connect --install' against a
live 'gbrain serve --http' (sandboxed HOME/CODEX_HOME), then assert via
'claude mcp get' / 'codex mcp get' that the server registered (and codex's token
stays out of config). Skips when the binary is absent. Perplexity is GUI-only so
it's print-asserted. Regen llms for the CLAUDE.md note.

* docs: perplexity OAuth + serve --bind/--public-url footgun (per Perplexity feedback)

PERPLEXITY.md now documents the host-side HTTP setup (gbrain serve --http
--bind 0.0.0.0 --public-url, the v0.34 ECONNREFUSED footgun) and the OAuth 2.1
client_credentials path (gbrain auth register-client) alongside the legacy
bearer token. The 'connect --agent perplexity' output points at the same
bind/public-url requirement + PERPLEXITY.md.

* feat: gbrain connect --oauth — client-credentials path for perplexity/generic

OAuth is the correct path for a third-party cloud connector (Perplexity): instead
of a long-lived full-access bearer token, the connector gets Issuer URL + Client
ID + Client Secret and mints short-lived scoped tokens. --oauth --register mints a
least-privilege client on the host (shells gbrain auth register-client); --oauth
--client-id/--client-secret uses an existing one. Rejected for claude-code/codex
(bearer) and with --install. Issuer derived from the mcp-url. New E2E proves the
full chain: register → connect --oauth → OAuth discovery → /token client_credentials
mint → get_brain_identity tool call against a live server. Docs: PERPLEXITY.md leads
with OAuth; README + CLAUDE.md updated; +18 unit cases.

* docs: add gbrain connect to INSTALL.md MCP section + link CODEX.md

The remote-client onboarding command was documented in README/CLAUDE_CODE/CODEX/
PERPLEXITY but missing from INSTALL.md §3 (the natural 'how do I connect a client'
home). Add the one-command connect how-to (claude-code/codex/perplexity) and the
missing docs/mcp/CODEX.md link.

* fix: connect LEARN_INSTRUCTION names put_page, not CLI-only capture

The self-orientation block told a connected agent that `capture` is an
available MCP tool. It isn't — `capture` is a CLI-only convenience command;
the MCP write tool is `put_page`. An agent that followed the instruction hit
"unknown tool". Drop capture; put_page was already in the list. Adds a
regression block to connect.test.ts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat: serve --http surfaces skill-publishing status (banner + nudge)

When mcp.publish_skills is OFF, connected agents can search/write but can't
call list_skills/get_skill, so the host's skill catalog is invisible to them.
The startup banner now shows a Skills: line, and a stderr nudge fires when off
with the paste-ready fix. Pure skillPublishStatus() helper, unit-tested.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test: prove the local stdio MCP funnel end-to-end

Spawns real `gbrain serve` (stdio) against a freshly init --pglite brain and
drives the official MCP SDK client through initialize -> tools/list ->
tools/call (get_brain_identity + search). Pins the advertised core-tool set
against what the server actually exposes (asserts capture is NOT advertised).
This funnel had zero e2e coverage before.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test: make batch-retry-audit ENOENT case hermetic

The 'no-op when audit dir does not exist' case called
pruneOldBatchRetryAuditFiles(30) without a GBRAIN_AUDIT_DIR override, so it
read the real ~/.gbrain/audit and flaked (kept:1) on any dev machine with a
batch-retry-*.jsonl on disk. Point it at a guaranteed-missing temp subdir,
matching this file's own hermetic-header contract.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs: two-funnel coding-agent onboarding (Claude Code / Codex)

New tutorial docs/tutorials/connect-coding-agent.md: Path A (connect to an
existing brain) + Path B (start from nothing, local stdio), the brain-first
protocol to paste into CLAUDE.md/AGENTS.md, and the four translatable habits.
README gains a 'Quick start: Claude Code or Codex' fork separating lightweight
retrieval from the full autonomous install. INSTALL.md shows the one-command
wire-up at the standalone CLI section. mcp/CLAUDE_CODE + CODEX cross-link the
tutorial + note publish_skills + capture-is-CLI-only. Tutorial promoted to
Shipped in the tutorials index.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: changelog + regenerated llms (v0.42.2.0)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs: CLAUDE.md Key Files annotation for two-funnel onboarding wave

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-01 19:09:15 -07:00

9.4 KiB

Give your coding agent a memory: GBrain + Claude Code / Codex

Coding agents got very good at code. They're still amnesiac about everything else. Claude Code and Codex forget your last conversation, can't tell you what you decided three meetings ago, and re-derive context you already have written down somewhere. GBrain is the retrieval layer that fixes that: search, synthesis, and a self-wiring knowledge graph, wired into your agent over MCP.

There are two ways to do this. Pick the one that matches where you are:

  • Path A — I already run a brain (OpenClaw, Hermes, or any gbrain serve host) and I want my Claude Code / Codex to reach the same brain. → jump to Path A
  • Path B — I have nothing yet. Spin up a local brain in 2 seconds and wire it into my coding agent. → jump to Path B

Both end in the same place: an agent that searches your brain before it answers, and writes new knowledge back as you work. The last section, Now make it actually useful, is the same for both and is the part that changes how you work.

Prerequisite for either path: bun install -g github:garrytan/gbrain.


Path A: connect an agent to a brain you already have

You already have a populated brain (the OpenClaw / Hermes case: it's on your agent host, full of meetings, people, and ideas). You want Claude Code on your laptop, and Codex too, to query it. This is the remote path: the host serves HTTP, your laptop agents connect with a token.

A1. On the host: serve over HTTP

If your host isn't already serving HTTP MCP, start it:

gbrain serve --http --bind 0.0.0.0 --public-url https://your-host.example.com

Two flags matter and people skip them:

  • --bind 0.0.0.0 — the default bind is 127.0.0.1 (loopback only), which silently refuses every remote connection. If your agent "can't reach the brain" and you didn't pass this, that's why. gbrain serve --http warns you at startup when --public-url is set without --bind.
  • --public-url — the externally reachable HTTPS URL (your Render/Railway URL, ngrok domain, Tailscale Funnel, etc.). It's the issuer the OAuth/MCP layer advertises.

Watch the startup banner. It now prints a Skills: line:

║  Skills:    published                                  ║

If it says not published, your connected agents will be able to search and write but won't see your skill catalog (the OpenClaw skills that make your setup special). Turn it on:

gbrain config set mcp.publish_skills true

(New brains from gbrain init default this ON. Brains upgraded from before v0.41.36 stay OFF until you opt in, so this is the common gotcha for existing OpenClaw users.)

A2. On the host: mint a token

gbrain auth create "laptop-agents"

Copy the gbrain_… token it prints. It's a long-lived, full-access secret. Treat it like a password; prefer a scoped OAuth client for anything cloud-hosted (see DEPLOY.md).

A3. On the laptop: one command per agent

# Claude Code
gbrain connect https://your-host.example.com/mcp --token gbrain_xxx --install

# Codex
gbrain connect https://your-host.example.com/mcp --token gbrain_xxx --agent codex --install

--install runs the agent's mcp add for you AND smoke-tests the token: it actually calls get_brain_identity before handing off, so a wrong or expired token fails right now, not silently on the agent's first request. You'll see:

Added MCP server 'gbrain' -> https://your-host.example.com/mcp.
Verified: {"version":"0.42.x","engine":"postgres","page_count":146646,...}

Drop --install to print a paste-ready block instead (useful when the host and the agent are different machines, or you want to read before you run). Codex reads the bearer from $GBRAIN_REMOTE_TOKEN at runtime, so the token never lands in Codex's config file. Keep that variable exported in your shell profile.

A4. Verify

In the agent: "Call get_brain_identity, then search my brain for [a topic you know is in there]." You should get your own pages back. Done.

Full per-client detail: Claude Code, Codex, Perplexity.


Path B: start from nothing (local brain, local agent)

No OpenClaw, no server, no token. The lowest-friction path in the whole product: a local PGLite brain in the same process your agent spawns. Zero server, zero tunnel.

B1. Create a local brain

gbrain init --pglite      # 2 seconds; embedded Postgres via WASM, no Docker

B2. Put something in it

A brain with nothing in it answers nothing, so an empty brain on day one feels broken. Two ways to fill it:

# Bulk-import a folder of markdown you already have:
gbrain import ~/notes/

# Or capture as you go (one thought at a time):
gbrain capture "Decided to use PGLite as the default engine: zero-config beats Postgres for <1000 files."

You don't have to import everything up front. The capture-as-you-go habit (see the next section) means the brain fills with the decisions and context you generate while working, and is genuinely useful by day two.

B3. Wire it into your coding agent

# Claude Code
claude mcp add gbrain -- gbrain serve

# Codex
codex mcp add gbrain -- gbrain serve

That's the whole wire-up. No token, no URL, no tunnel. The agent spawns gbrain serve as a stdio subprocess and talks to your local brain directly.

B4. Verify

In the agent: "search my brain for PGLite" (or whatever you just captured). You get the page back. The same brain is now query-able from the CLI (gbrain query "...") and from your agent.


Now make it actually useful

Connecting is the easy part. The value comes from teaching your agent a few habits. These are the patterns that turn a coding agent into a knowledge-aware one. Paste the protocol below into your agent's instructions file (CLAUDE.md for Claude Code, AGENTS.md for Codex / Cursor / others), then lean on the patterns.

The brain-first protocol (paste this in)

## Brain-first protocol

You have a knowledge brain connected over MCP. Before answering any question
about people, companies, decisions, projects, or past context:

1. **Search first.** Call `search` (or `query` for a synthesized answer) against
   the brain BEFORE answering from memory or asking me. If the brain has the
   answer, use it. Never ask "who is X?" or "what did we decide about Y?" before
   searching — the brain probably already knows.
2. **Write back.** When I make a decision, mention a new person/company, or land
   on an idea worth keeping, write it to the brain with `put_page` (entity pages
   under people/, companies/; decisions under decisions/ or notes/). One insight,
   one page, linked.
3. **Cite.** When you answer from the brain, name the page you used.

The four patterns worth stealing

These come straight from a production OpenClaw setup. They translate directly to any coding agent with GBrain connected:

1. Brain-first lookup (never ask what you can retrieve). The single highest- value habit. Before the agent asks you "which repo?" or "who owns this?", it searches. Try: "What did we decide about the auth rewrite?" and watch it pull the decision page instead of asking you to re-explain.

2. Ambient capture (your brain as a side effect of working). Don't make saving a separate chore. Tell the agent: "As we work, capture any decision or new idea to the brain without interrupting." After a month of this, you have hundreds of linked pages and patterns you didn't know were there.

3. Briefing from your brain (not from the internet). "What do I need to know before my 2pm with the Acme team?" pulls your meeting history, the people, what's still open, what the brain doesn't know yet. The agent does your prep because it read your context. (query gives you the synthesized answer with citations; this is the example on the README.)

4. whoknows (expertise routing). "Who do I know who's shipped a rate limiter in Postgres?" The find_experts tool ranks people in your brain by relevance + recency. Useful the moment your brain has more than a handful of people in it.

That's the spine of it. Two commands to connect, one protocol to paste, four habits to build. Your agent stops being amnesiac.


Troubleshooting

Symptom Cause Fix
Agent "can't reach the brain" (Path A) gbrain serve --http bound to loopback Restart with --bind 0.0.0.0
list_skills returns nothing / errors Skill publishing OFF on the host gbrain config set mcp.publish_skills true
Token rejected on first call Wrong/expired token Re-mint with gbrain auth create; --install smoke-tests it for you
unknown tool: capture capture is CLI-only, not an MCP tool Use put_page over MCP; capture only on the CLI
Empty results (Path B) Brain has nothing in it yet gbrain import ~/notes/ or gbrain capture "..."

Next steps