* fix: gbrain auth create dropped the name on the bare (no-flag) form Extract parseAuthCreateArgs; only exclude the --takes-holders value from the positional search when the flag is present (rest[takesIdx+1] resolved to rest[0] when takesIdx === -1, silently dropping the name). Add regression test. * feat: gbrain connect — one-command Claude Code onboarding from a bearer token New connect command prints a paste-ready claude-mcp-add block (or --install wires it + smoke-tests the token via a raw-bearer get_brain_identity probe). Direct HTTP MCP, literal-token default, URL normalization, token header-injection guard, --json redaction, execFileSync (no shell). Wired into CLI_ONLY + CLI_ONLY_SELF_HELP + handleCliOnly. 58 unit + 3 PGLite-E2E cases; e2e-test-map updated. * docs: lead CLAUDE_CODE.md with gbrain connect (remote fast path) + README one-liner Regenerate llms-full.txt for the README change. * refactor: pre-landing review fixes for gbrain connect - DRY: single DEFAULT_PROBE_TIMEOUT_MS + shared isAuthErrorMessage predicate - reuse promptLine (shared stdin lifecycle) for the --install confirm - harden redactToken with a Bearer <value> scrub (defense in depth) - +8 tests: orchestrator guard paths, deterministic timeout, invalid --timeout-ms, Bearer-redaction * fix: adversarial-review hardening for gbrain connect - probe: Promise.race the call against a real timer so a stalled connect()/SSE handshake (signal alone doesn't cover it) can't hang --install indefinitely - probe: close transport even if client.connect() throws - parseArgs: reject a missing/flag-shaped value (e.g. --token --install) - block link-local / cloud-metadata hosts (169.254/fe80:/fd00:ec2::254) — keeps localhost + RFC1918 LAN brains working - non-interactive --install now requires --yes - clearer message when --force removed then add failed +8 tests covering each * fix: codex-review P2s for gbrain connect - POSIX single-quote the rendered claude-mcp-add command so a token with shell metacharacters ($(), backticks) can't trigger command substitution on paste - detect IPv4-mapped IPv6 metadata addresses (::ffff:169.254.x.x / ::ffff:a9fe:*) so they don't bypass the link-local guard +3 tests * chore: bump version and changelog (v0.42.2.0) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: document gbrain connect + connect-probe in CLAUDE.md Key files (v0.42.2.0) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat: gbrain connect — add codex and perplexity agents --agent codex emits 'codex mcp add ... --bearer-token-env-var GBRAIN_REMOTE_TOKEN' (token read from the env var at runtime, never in Codex config; --install runs it). --agent perplexity prints the URL + token for the Settings → Connectors GUI (no --install). Generalized the command file: AGENT_SPECS table, buildCodexMcpAddArgv, cmdString(binary,argv), binary-generic ConnectDeps (hasBinary/runBinary/env), agent-aware buildConnectBlock/buildJson. +25 tests. * docs: codex + perplexity connect paths (new CODEX.md, README, CHANGELOG, CLAUDE.md) Regenerate llms-full.txt for the CLAUDE.md/README edits. * test: real-CLI E2E for connect — drive actual claude + codex against a live server Adds claude-code + codex cases to connect-bearer.test.ts that run the real 'claude mcp add' / 'codex mcp add' through 'gbrain connect --install' against a live 'gbrain serve --http' (sandboxed HOME/CODEX_HOME), then assert via 'claude mcp get' / 'codex mcp get' that the server registered (and codex's token stays out of config). Skips when the binary is absent. Perplexity is GUI-only so it's print-asserted. Regen llms for the CLAUDE.md note. * docs: perplexity OAuth + serve --bind/--public-url footgun (per Perplexity feedback) PERPLEXITY.md now documents the host-side HTTP setup (gbrain serve --http --bind 0.0.0.0 --public-url, the v0.34 ECONNREFUSED footgun) and the OAuth 2.1 client_credentials path (gbrain auth register-client) alongside the legacy bearer token. The 'connect --agent perplexity' output points at the same bind/public-url requirement + PERPLEXITY.md. * feat: gbrain connect --oauth — client-credentials path for perplexity/generic OAuth is the correct path for a third-party cloud connector (Perplexity): instead of a long-lived full-access bearer token, the connector gets Issuer URL + Client ID + Client Secret and mints short-lived scoped tokens. --oauth --register mints a least-privilege client on the host (shells gbrain auth register-client); --oauth --client-id/--client-secret uses an existing one. Rejected for claude-code/codex (bearer) and with --install. Issuer derived from the mcp-url. New E2E proves the full chain: register → connect --oauth → OAuth discovery → /token client_credentials mint → get_brain_identity tool call against a live server. Docs: PERPLEXITY.md leads with OAuth; README + CLAUDE.md updated; +18 unit cases. * docs: add gbrain connect to INSTALL.md MCP section + link CODEX.md The remote-client onboarding command was documented in README/CLAUDE_CODE/CODEX/ PERPLEXITY but missing from INSTALL.md §3 (the natural 'how do I connect a client' home). Add the one-command connect how-to (claude-code/codex/perplexity) and the missing docs/mcp/CODEX.md link. * fix: connect LEARN_INSTRUCTION names put_page, not CLI-only capture The self-orientation block told a connected agent that `capture` is an available MCP tool. It isn't — `capture` is a CLI-only convenience command; the MCP write tool is `put_page`. An agent that followed the instruction hit "unknown tool". Drop capture; put_page was already in the list. Adds a regression block to connect.test.ts. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat: serve --http surfaces skill-publishing status (banner + nudge) When mcp.publish_skills is OFF, connected agents can search/write but can't call list_skills/get_skill, so the host's skill catalog is invisible to them. The startup banner now shows a Skills: line, and a stderr nudge fires when off with the paste-ready fix. Pure skillPublishStatus() helper, unit-tested. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: prove the local stdio MCP funnel end-to-end Spawns real `gbrain serve` (stdio) against a freshly init --pglite brain and drives the official MCP SDK client through initialize -> tools/list -> tools/call (get_brain_identity + search). Pins the advertised core-tool set against what the server actually exposes (asserts capture is NOT advertised). This funnel had zero e2e coverage before. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: make batch-retry-audit ENOENT case hermetic The 'no-op when audit dir does not exist' case called pruneOldBatchRetryAuditFiles(30) without a GBRAIN_AUDIT_DIR override, so it read the real ~/.gbrain/audit and flaked (kept:1) on any dev machine with a batch-retry-*.jsonl on disk. Point it at a guaranteed-missing temp subdir, matching this file's own hermetic-header contract. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: two-funnel coding-agent onboarding (Claude Code / Codex) New tutorial docs/tutorials/connect-coding-agent.md: Path A (connect to an existing brain) + Path B (start from nothing, local stdio), the brain-first protocol to paste into CLAUDE.md/AGENTS.md, and the four translatable habits. README gains a 'Quick start: Claude Code or Codex' fork separating lightweight retrieval from the full autonomous install. INSTALL.md shows the one-command wire-up at the standalone CLI section. mcp/CLAUDE_CODE + CODEX cross-link the tutorial + note publish_skills + capture-is-CLI-only. Tutorial promoted to Shipped in the tutorials index. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: changelog + regenerated llms (v0.42.2.0) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: CLAUDE.md Key Files annotation for two-funnel onboarding wave Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
9.4 KiB
Give your coding agent a memory: GBrain + Claude Code / Codex
Coding agents got very good at code. They're still amnesiac about everything else. Claude Code and Codex forget your last conversation, can't tell you what you decided three meetings ago, and re-derive context you already have written down somewhere. GBrain is the retrieval layer that fixes that: search, synthesis, and a self-wiring knowledge graph, wired into your agent over MCP.
There are two ways to do this. Pick the one that matches where you are:
- Path A — I already run a brain (OpenClaw, Hermes, or any
gbrain servehost) and I want my Claude Code / Codex to reach the same brain. → jump to Path A - Path B — I have nothing yet. Spin up a local brain in 2 seconds and wire it into my coding agent. → jump to Path B
Both end in the same place: an agent that searches your brain before it answers, and writes new knowledge back as you work. The last section, Now make it actually useful, is the same for both and is the part that changes how you work.
Prerequisite for either path: bun install -g github:garrytan/gbrain.
Path A: connect an agent to a brain you already have
You already have a populated brain (the OpenClaw / Hermes case: it's on your agent host, full of meetings, people, and ideas). You want Claude Code on your laptop, and Codex too, to query it. This is the remote path: the host serves HTTP, your laptop agents connect with a token.
A1. On the host: serve over HTTP
If your host isn't already serving HTTP MCP, start it:
gbrain serve --http --bind 0.0.0.0 --public-url https://your-host.example.com
Two flags matter and people skip them:
--bind 0.0.0.0— the default bind is127.0.0.1(loopback only), which silently refuses every remote connection. If your agent "can't reach the brain" and you didn't pass this, that's why.gbrain serve --httpwarns you at startup when--public-urlis set without--bind.--public-url— the externally reachable HTTPS URL (your Render/Railway URL, ngrok domain, Tailscale Funnel, etc.). It's the issuer the OAuth/MCP layer advertises.
Watch the startup banner. It now prints a Skills: line:
║ Skills: published ║
If it says not published, your connected agents will be able to search and
write but won't see your skill catalog (the OpenClaw skills that make your setup
special). Turn it on:
gbrain config set mcp.publish_skills true
(New brains from gbrain init default this ON. Brains upgraded from before
v0.41.36 stay OFF until you opt in, so this is the common gotcha for existing
OpenClaw users.)
A2. On the host: mint a token
gbrain auth create "laptop-agents"
Copy the gbrain_… token it prints. It's a long-lived, full-access secret. Treat
it like a password; prefer a scoped OAuth client for anything cloud-hosted (see
DEPLOY.md).
A3. On the laptop: one command per agent
# Claude Code
gbrain connect https://your-host.example.com/mcp --token gbrain_xxx --install
# Codex
gbrain connect https://your-host.example.com/mcp --token gbrain_xxx --agent codex --install
--install runs the agent's mcp add for you AND smoke-tests the token: it
actually calls get_brain_identity before handing off, so a wrong or expired
token fails right now, not silently on the agent's first request. You'll see:
Added MCP server 'gbrain' -> https://your-host.example.com/mcp.
Verified: {"version":"0.42.x","engine":"postgres","page_count":146646,...}
Drop --install to print a paste-ready block instead (useful when the host and
the agent are different machines, or you want to read before you run). Codex
reads the bearer from $GBRAIN_REMOTE_TOKEN at runtime, so the token never lands
in Codex's config file. Keep that variable exported in your shell profile.
A4. Verify
In the agent: "Call get_brain_identity, then search my brain for [a topic you know is in there]." You should get your own pages back. Done.
Full per-client detail: Claude Code, Codex, Perplexity.
Path B: start from nothing (local brain, local agent)
No OpenClaw, no server, no token. The lowest-friction path in the whole product: a local PGLite brain in the same process your agent spawns. Zero server, zero tunnel.
B1. Create a local brain
gbrain init --pglite # 2 seconds; embedded Postgres via WASM, no Docker
B2. Put something in it
A brain with nothing in it answers nothing, so an empty brain on day one feels broken. Two ways to fill it:
# Bulk-import a folder of markdown you already have:
gbrain import ~/notes/
# Or capture as you go (one thought at a time):
gbrain capture "Decided to use PGLite as the default engine: zero-config beats Postgres for <1000 files."
You don't have to import everything up front. The capture-as-you-go habit (see the next section) means the brain fills with the decisions and context you generate while working, and is genuinely useful by day two.
B3. Wire it into your coding agent
# Claude Code
claude mcp add gbrain -- gbrain serve
# Codex
codex mcp add gbrain -- gbrain serve
That's the whole wire-up. No token, no URL, no tunnel. The agent spawns
gbrain serve as a stdio subprocess and talks to your local brain directly.
B4. Verify
In the agent: "search my brain for PGLite" (or whatever you just captured). You
get the page back. The same brain is now query-able from the CLI
(gbrain query "...") and from your agent.
Now make it actually useful
Connecting is the easy part. The value comes from teaching your agent a few
habits. These are the patterns that turn a coding agent into a knowledge-aware
one. Paste the protocol below into your agent's instructions file
(CLAUDE.md for Claude Code, AGENTS.md for Codex / Cursor / others), then lean
on the patterns.
The brain-first protocol (paste this in)
## Brain-first protocol
You have a knowledge brain connected over MCP. Before answering any question
about people, companies, decisions, projects, or past context:
1. **Search first.** Call `search` (or `query` for a synthesized answer) against
the brain BEFORE answering from memory or asking me. If the brain has the
answer, use it. Never ask "who is X?" or "what did we decide about Y?" before
searching — the brain probably already knows.
2. **Write back.** When I make a decision, mention a new person/company, or land
on an idea worth keeping, write it to the brain with `put_page` (entity pages
under people/, companies/; decisions under decisions/ or notes/). One insight,
one page, linked.
3. **Cite.** When you answer from the brain, name the page you used.
The four patterns worth stealing
These come straight from a production OpenClaw setup. They translate directly to any coding agent with GBrain connected:
1. Brain-first lookup (never ask what you can retrieve). The single highest- value habit. Before the agent asks you "which repo?" or "who owns this?", it searches. Try: "What did we decide about the auth rewrite?" and watch it pull the decision page instead of asking you to re-explain.
2. Ambient capture (your brain as a side effect of working). Don't make saving a separate chore. Tell the agent: "As we work, capture any decision or new idea to the brain without interrupting." After a month of this, you have hundreds of linked pages and patterns you didn't know were there.
3. Briefing from your brain (not from the internet). "What do I need to know
before my 2pm with the Acme team?" pulls your meeting history, the people,
what's still open, what the brain doesn't know yet. The agent does your prep
because it read your context. (query gives you the synthesized answer with
citations; this is the example on the README.)
4. whoknows (expertise routing). "Who do I know who's shipped a rate
limiter in Postgres?" The find_experts tool ranks people in your brain by
relevance + recency. Useful the moment your brain has more than a handful of
people in it.
That's the spine of it. Two commands to connect, one protocol to paste, four habits to build. Your agent stops being amnesiac.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| Agent "can't reach the brain" (Path A) | gbrain serve --http bound to loopback |
Restart with --bind 0.0.0.0 |
list_skills returns nothing / errors |
Skill publishing OFF on the host | gbrain config set mcp.publish_skills true |
| Token rejected on first call | Wrong/expired token | Re-mint with gbrain auth create; --install smoke-tests it for you |
unknown tool: capture |
capture is CLI-only, not an MCP tool |
Use put_page over MCP; capture only on the CLI |
| Empty results (Path B) | Brain has nothing in it yet | gbrain import ~/notes/ or gbrain capture "..." |
Next steps
- Go full autonomous: the overnight enrichment daemon (dream cycle) fixes citations, dedupes people, builds scorecards while you sleep. See
gbrain autopilot --install. - Run a real agent platform on top: personal-brain tutorial.
- Scale to a team: company-brain tutorial.
- Every MCP client's exact setup:
docs/mcp/.