Connect an agent from the browser
Add Stratta as a remote MCP connector: one address, a browser sign-in, and no key to copy.
There are two ways to reach Stratta. This is the shorter one, and the only one that works in cloud agents such as ChatGPT, Codex cloud, or claude.ai, where nothing executes on a machine you control.
The address
https://stratta.ch/mcp
In your agent, add an MCP connector with this address. There is nothing to install: no Node, no Python, no API key.
In ChatGPT, install the published Stratta plugin. During private testing, enable Developer mode under Settings > Security and login, then add the MCP server URL above. ChatGPT scans the 32 remote tools and starts the Stratta OAuth flow when an authenticated tool is first used.
From a terminal:
claude mcp add --transport http stratta --scope user https://stratta.ch/mcpWhat happens next
On its first call your agent finds out it needs authorisation and sends you to a page on Stratta. It shows three things:
- which application is asking. The name is declared by the application itself, so accept it only if you have just added it;
- which account is being committed, with a way to switch;
- which organisation will be read.
You authorise, or you refuse. Nothing is decided without that click.
Access covers every published norm in your organisation and your dossiers, on behalf of your account, until you withdraw it.
Withdrawing access
In your workspace, Connected agents lists the authorised applications and lets you disconnect them. A disconnected application loses access immediately and has to ask you again.
A connector is invisible by nature: it lives inside another application and shows no key. That is what this page is for.
Ingesting through the connector
The ingest_* tools are served to the connector. The pre-pass still reads a
PDF on a machine: an agent that has one (Claude Code, Codex, Cursor, Gemini
CLI) ingests through the connector, with no npm package and no key. It needs
Python 3 with PyMuPDF and the pre-pass script, which it downloads from
https://stratta.ch/ingest-prepass.py when it is not already on disk; the
procedure is served to it as the resource stratta://skills/ingest-norm.
Claude on the web and ChatGPT cannot ingest: nothing runs on a machine of
yours there.
When the local server is the right one
Two cases, and they are clear-cut:
- A dossier attachment read from your disk (
add_attachment). It is the one tool the connector does not serve: use the local server. - An agent with no browser. A CI job, a scheduled task, a server: nothing there can open the authorisation page. It needs an API key.
Both paths read the same corpus, count against the same quota and apply the same tenancy rules. Only the way you prove who you are differs.
The remote connector exposes 35 tools. The local server exposes 36, the local attachment on top.
Security
- The access token lives one hour and renews itself. An API key lives until you revoke it.
- The exchange follows OAuth 2.1 with PKCE
S256. The authorization code is single-use. - Losing membership of the organisation cuts the agent off on its very next call: membership is re-checked every time, never read from the token.