# Connect other MCP clients to ODUS

Any MCP client that supports remote servers over Streamable HTTP with OAuth can connect to ODUS. Give it the server URL, `https://mcp.odus.com/mcp`, and nothing else.

The client finds the ODUS sign-in from the URL, registers itself and opens your browser. Leave any client ID, client secret or API key field empty. Then sign in and approve, as [Sign in and approve](https://docs.odus.com/docs/guides/ai-connector/.md#sign-in-and-approve) describes.

## Codex

Add the server, then sign in:

```
codex mcp add odus --url https://mcp.odus.com/mcp

codex mcp login odus
```

The first command writes this to `~/.codex/config.toml`, which you can also edit by hand:

```
[mcp_servers.odus]

url = "https://mcp.odus.com/mcp"
```

## Gemini CLI

Add the server, then sign in from inside Gemini CLI:

```
gemini mcp add --transport http odus https://mcp.odus.com/mcp
```

```
/mcp auth odus
```

## Windsurf and other clients

If your client's documentation says it signs in to remote MCP servers with OAuth, give it the server URL. Otherwise, use `mcp-remote`, below.

## Clients that only run local servers

Some clients run MCP servers only as local commands. [`mcp-remote`](https://www.npmjs.com/package/mcp-remote) is an open-source command that runs on your machine and connects such a client to a remote server, signing in through your browser. It needs Node.js 18 or later.

Add it as a local server in your client's configuration. Most clients use this shape. In Windsurf, the file is `~/.codeium/windsurf/mcp_config.json`:

```
{

  "mcpServers": {

    "odus": {

      "command": "npx",

      "args": ["-y", "mcp-remote", "https://mcp.odus.com/mcp"]

    }

  }

}
```

The first time the client starts it, your browser opens the ODUS Dashboard. `mcp-remote` keeps the sign-in in `~/.mcp-auth` on your machine.

## Building your own client

If you build an MCP client, it connects the standard way:

* `POST` to the server URL without a token answers `401` with a `WWW-Authenticate` header that points at the protected resource metadata (RFC 9728), which names the ODUS authorization server.
* The authorization server publishes its metadata (RFC 8414). It supports the authorization code grant with PKCE (`S256`) and refresh tokens, for public clients only: register with `token_endpoint_auth_method` set to `none`.
* Register with dynamic client registration (RFC 7591), or use a Client ID Metadata Document URL as your client ID.
* Request the `offline_access` scope, and send the server URL as the `resource` parameter (RFC 8707).
* A web client's redirect URI must use `https`. A native client uses `http` on `localhost`, `127.0.0.1` or `[::1]`, on any port. Private-use schemes such as `com.example.app:/callback` are not supported.
* Refresh tokens rotate on every use. Store the new one each time: reusing an old one ends the connection.