Connect your AI agent

Give your agent this address, sign in with your sov.gg account when it asks, and you are connected. There is no token to create or paste.

https://mcp.sov.gg/mcp

Windows: one-step setup

Installs Claude Code (and Git, if it is missing), adds sov, and asks you for your Authentik token. It asks for administrator rights first. Open a PowerShell window and paste:

irm https://mcp.sov.gg/connect/setup.ps1 | iex

Or download the script (sov-mcp-setup.ps1), right-click it and choose Run with PowerShell. It is short and plain text, so read it first if you like.

The token you type is hidden and goes only to Claude Code's settings. Leave it empty to sign in through the browser instead, which does not expire.

Claude (web, desktop and mobile)

1. Open Settings, then Connectors, then Add custom connector.
2. Name it sov, paste the address above, and add it.
3. Choose Connect. A sign-in page opens; sign in as you normally do for sov.gg.

On a Team or Enterprise plan an Owner adds the connector once for the organization; after that each person chooses Connect for their own account.

Claude Code

claude mcp add --transport http sov https://mcp.sov.gg/mcp

Then, inside Claude Code, run /mcp, pick sov and choose Authenticate. Your browser opens the sign-in page.

Cursor

Add this to ~/.cursor/mcp.json (or the project's .cursor/mcp.json), then use the sign-in prompt Cursor shows next to sov:

{
  "mcpServers": {
    "sov": {
      "url": "https://mcp.sov.gg/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"sov","type":"http","url":"https://mcp.sov.gg/mcp"}'

Start the sov server from the MCP servers list; VS Code opens the sign-in page.

Any other agent

If it can add a remote MCP server by address and sign in through the browser, give it https://mcp.sov.gg/mcp and nothing else. If it only lets you set a fixed Authorization header, see the last section.

Check that it worked

Ask your agent to call the whoami tool on sov. It names your account and says whether you can change things or only read.

Access comes from two groups in Authentik: ai-agent-read (read) and ai-agent-write (read and change). Ask an admin if you are in neither.

When something goes wrong

The sign-in page says you are not allowed to use this application

Your account is not in ai-agent-read. Ask an admin to add you.

The sign-in page shows a "redirect URI" error

That agent's return address has not been added yet. Send an admin the address in the error; they add it to the mcp-gateway application in Authentik and you try again.

You already pasted a token into the agent's settings

Remove it (the Authorization header) and connect again as above. The pasted tokens stop working every 30 minutes; this sign-in renews itself.

It asks you to sign in again every so often

Sign-in is renewed in the background for about a month at a time. If you are removed from the group, access ends within about 10 minutes.

Agents that can only send a fixed header

Create an API token in Authentik (User Settings, Tokens) and send it as Authorization: Bearer <token> to https://mcp.sov.gg/mcp. These tokens rotate roughly every 30 minutes unless an admin makes you a non-expiring one, which is why signing in as above is preferred.