Connect a local agent

All agent connection guides

Connect without entering identity fields

Open Library → Agents → Connect agent and choose where your agent runs.

• Claude Code on your machine or another local coding agent / terminal: choose a stable connection name, then copy the setup prompt into that local agent. It must have Node 20+, outbound HTTPS, persistent private storage, and access to the intended project. The prompt checks these capabilities before running the connector.
• Claude.ai: add https://fooguard.com/mcp as a custom connector in Claude’s Settings → Connectors. Sign in to Foo Guard, select Personal or a Team workspace you administer, and authorize. Return to Claude and ask it to check its Foo Guard connection. Other hosted clients are not supported in this initial release.

Do not infer a client version from a model name. If the local agent cannot execute commands, stop and use a terminal on the intended machine; do not substitute an unrelated sandbox. There is no required MCP server or plugin for local reporting.

The browser shows the requested workspace, the agent's self-reported name, and a confirmation code. Only approve a request you started, and compare the code with the connector's output. Personal connections require the workspace owner. Team connections require an active owner or administrator and any configured company sign-in.

Authorization creates the Library identity. The first accepted report confirms reporting. Copying the prompt or approving the request alone does not prove that the connector has reported. Follow its View agent link, or refresh the Agents page.

Manual setup

Download the official connector, review the file, and run:

node fooguard-connect.mjs --help
node fooguard-connect.mjs --connection my-agent --name "My coding agent" --runtime "My client/version"

Add --workspace your-team-slug for Team. The Library setup prompt supplies the correct workspace automatically. The default local profile is scoped to the detected client family and current working folder. Use --connection a-short-label to choose a stable profile explicitly for a separate local agent installation. Reuse that label on later reports, including when changing directories. Changing --name alone does not select a different connection profile. Credentials are stored in a private file under your home directory, outside your repository; do not copy that file into chat or source control.

Report selected configs and skills

The connector sends no file contents. Explicitly select files inside the current directory:

node fooguard-connect.mjs --connection my-agent --file .claude/skills/review/SKILL.md --file agent.json

This displays the proposed relative filenames, kinds, and SHA-256 fingerprints without sending them. Review the output, then repeat with --approve-metadata. Retain the same workspace and connection options used during setup. Files must be regular files up to 256 KiB; each report supports at most 100 files.

Reports replace the latest reported inventory. Running without selected files reports an empty inventory. Reporting is on demand, not a background monitor. Fingerprints are evidence of the submitted files, not proof that an agent loaded or executed them. Reports do not change deterministic security scores.

Optional Gateway

Team Gateway access is separate. In Gateway setup, select the existing Library agent before registering its Gateway credential. Creating a new Gateway agent also creates its Library identity. Existing legacy Gateway entries remain separate and are not merged by name.

Reporting credentials cannot download Library files, run scans, call models, or execute tools. Gateway credentials and model access require their own explicit setup. Workspace-wide policy controls affect all routed agents. Registration alone does not prove traffic is routed.