Connect another client

Any MCP client that speaks Streamable HTTP can connect: with OAuth sign-in if it supports it, or with an access token in a header.

With sign-in (OAuth)

Give the client the MCP URL, https://mcp.reliquary.redmage.cc/mcp (your Connect page shows the one to use). A client that follows the MCP authorization spec finds Reliquary's sign-in from the URL's first 401 answer, sends you to consent, and keeps its own refreshed tokens.

Reliquary identifies clients by a Client ID Metadata Document (an https URL); there is no dynamic client registration.

With a token

1. On the Connect page, choose the Other clients tab and choose Create read-only token (or Create read and write token). It reaches all your vaults and expires in 90 days; for some vaults or another expiry, choose use the full form. If you belong to more than one vault, the tab shows Choose vaults and create a token instead, which opens the full form, where nothing is chosen for you: see Keep client work separate. The page that follows shows the token once.

2. Configure the client with the MCP URL and this header, reading the token from wherever the client keeps secrets:

   Authorization: Bearer <your token>
   

Tokens are for clients without sign-in: headless agents like Hermes, scripts, CI. Keep them out of chats and out of files an agent can read.

Check it

The page that shows your token also gives a test command, for bash or zsh (curl) and for PowerShell (Invoke-RestMethod). It sets the token in your terminal, then calls tools/list; a JSON answer that lists tools means the token works. The tools are in MCP tools. list_vaults returns the vaults the token reaches, with your role in each.

Once the client has used the token, the Connect page says Connected and names it, for 15 minutes. Reload the page to see it.

Environment variables

MCP never carries variable values. For a program that needs them, use the CLI: reliquary run or reliquary env pull. See Use the CLI.

Troubleshooting

• No token: send Authorization: Bearer <token>: the client sent no Authorization header, or the place it reads the token from was empty when it started. Fix the header or the secret, then restart the client.
• "The token isn’t live: it is unknown, expired or revoked, or was issued for another resource", or a tool call says "This token was revoked or expired during the request. Reconnect.": the token expired or was revoked. Make a new one on the Connect page and give it to the client. If it leaked, see Rotate a leaked token.
• It can't see a vault: the token's vaults were chosen without it, or you aren't a member. list_vaults shows the ones it reaches. Make a new token that reaches it.
• Writes are refused: the token is read only, or you are a viewer in that vault, or the file is canon (use a proposal). See Canon, open and rules.

Any other refusal says what was being done, where and why, with a reference: see Errors and reference IDs.