# Shared MCP servers and agent setups

> Share MCP server definitions, skills and prompts with your team for Claude Code and Codex, with secrets referenced from the vault and resolved for each person when the server starts.

Source: https://docs.subcloak.com/cloak-proxy/team/agent-setups/

Added in Cloak Proxy 0.7.0.

{/* L9 draft. Sources: PLAN 7.13, 10 (AgentSetupCenter Team tab); 12.3 item 38. Re-check labels against L7/L8. */}

The team's **Agents** space holds MCP server definitions, agent setups (which MCP servers, skills and prompts to install for Claude Code or Codex) and skills and prompts as text. Anyone in the team can install them in one step. Secrets aren't copied into them: a definition points at the [team vault](https://docs.subcloak.com/cloak-proxy/team/vault/), and each person's own access decides what their server gets.

## Publish an MCP server

{/* PLAN 7.13 */}

Open **Agents** under **Team: Acme**, or the **Team** tab in the agent setup window, and add a server: its name, transport (`stdio` or `http`), command and arguments or URL, environment variables and headers. Each environment variable or header value is one of:

| Value | What the person running it gets |
|---|---|
| A literal value | The text as written. Not for secrets. |
| A team vault reference, shown as `vault:team/NAME` | The item's value, if they can open its folder |
| A personal vault reference | The value from their own Keychain vault |
| A prompt | Cloak Proxy asks them once, when they install it, and keeps the answer in this Mac's Keychain |

## Never keys

{/* PLAN 7.13 never keys */}

When you publish a server, Cloak Proxy runs the share leak check (the known-secret formats plus a randomness check) on every literal value in the environment, arguments, URL and headers, and checks its name and prompts for known secret formats. Skills and prompts are checked for known secret formats only. If one looks like a secret, publishing is refused: "This looks like a secret. Move it to the team vault, or to your own vault." Every Mac that installs a definition runs the same check and refuses to install one with a literal secret in it.

> **Who checks:**
> Subcloak's server can't see the definitions (unless an admin turns on automatic approval after SSO), so the check runs on the Mac that publishes and on every Mac that installs. Like all redaction in Cloak Proxy, it recognizes common secret formats, not every possible secret. Put secrets in the vault rather than relying on the check.

## Install a server or a setup

{/* PLAN 7.13 installing */}

1. Open the agent setup window's **Team** tab, or **Agents** under **Team: Acme**.

2. Choose a server, skill, prompt or setup and click **Install** for Claude Code or Codex. For a server, Cloak Proxy shows the command it will run (or the URL it connects to) and the vault items it will fill in; for a skill or prompt, every file's text, with text an agent would run (`` !` `` commands and ```` ```! ```` blocks) and `allowed-tools` pointed out. Installing is your OK for exactly that version.

A definition Cloak Proxy can't show in full (a field it doesn't know, a value of another shape, a name given twice) can't be installed or approved: **Agents** says why.

For a local (`stdio`) server, Cloak Proxy writes the agent's config entry so that it starts `cloakctl mcp-exec --team <team id> --space <space id> --server <id> --pin <hash>`. For an `http` server, both Claude Code and Codex start `cloakctl mcp-exec` too, which connects to its URL for them. An `http` server's URL must be `https` (plain `http` only for a server on this Mac), and redirects aren't followed. That command looks up the definition in that one space and starts it only if it's still the version you approved. It fills in the vault references that version names **for the person running it**, from their own team vault access and Keychain, and then starts the real server with those values. No secret value is written to `~/.claude.json` or any other agent config file.

Your own MCP servers, skills and prompts are left alone: if one already has the name, installing stops and asks you to rename one of them. Skills go to `~/.claude/skills/<name>/` or `~/.codex/skills/<name>/`, prompts to `~/.claude/commands/<name>.md` or `~/.codex/prompts/<name>.md`. Names starting with `cloak-proxy` are kept for Cloak Proxy's own skills. There's no **Uninstall** yet: to remove something you installed, delete its entry from the agent's config, or its skill folder or prompt file. Deleting an item from the team, or leaving the team, doesn't remove what's already installed on your Mac (a server stops starting; a skill or prompt stays until you delete it).

If someone in the team changes a server you installed, it doesn't start until you look at the change: **Agents** marks it **Changed since you approved it** and lists what changed, field by field for a server and file by file for a skill or prompt; **Approve This Version** (or **Update**) installs it. A server you change yourself is approved for you, if what you edited was the version you had approved; if a teammate's change was still waiting for your review, it keeps waiting.

If you can't open a vault item a server needs, it says so: "You don't have access to team vault item STRIPE_KEY. Ask a manager of the 'Staging' folder."

## Related

  - [Team vault](https://docs.subcloak.com/cloak-proxy/team/vault/): Folders, access and vault references.
  - [MCP server](https://docs.subcloak.com/cloak-proxy/automation/mcp-server/): Cloak Proxy's own MCP server.
  - [Agent skills and setup tools](https://docs.subcloak.com/cloak-proxy/automation/agent-skills/): Skills for Claude Code and Codex.