Shared MCP servers and agent setups

The team’s Agents space holds MCP server definitions, agent setups (which MCP servers, skills and prompts to install for Claude Code or Codex) and skills and prompts as text. Anyone in the team can install them in one step. Secrets aren’t copied into them: a definition points at the team vault, and each person’s own access decides what their server gets.

Publish an MCP server

Open Agents under Team: Acme, or the Team tab in the agent setup window, and add a server: its name, transport (stdio or http), command and arguments or URL, environment variables and headers. Each environment variable or header value is one of:

Value	What the person running it gets
A literal value	The text as written. Not for secrets.
A team vault reference, shown as vault:team/NAME	The item’s value, if they can open its folder
A personal vault reference	The value from their own Keychain vault
A prompt	Cloak Proxy asks them once, when they install it, and keeps the answer in this Mac’s Keychain

Never keys

When you publish a server, Cloak Proxy runs the share leak check (the known-secret formats plus a randomness check) on every literal value in the environment, arguments, URL and headers, and checks its name and prompts for known secret formats. Skills and prompts are checked for known secret formats only. If one looks like a secret, publishing is refused: “This looks like a secret. Move it to the team vault, or to your own vault.” Every Mac that installs a definition runs the same check and refuses to install one with a literal secret in it.

Who checks

Subcloak’s server can’t see the definitions (unless an admin turns on automatic approval after SSO), so the check runs on the Mac that publishes and on every Mac that installs. Like all redaction in Cloak Proxy, it recognizes common secret formats, not every possible secret. Put secrets in the vault rather than relying on the check.

Install a server or a setup

1. Open the agent setup window’s Team tab, or Agents under Team: Acme.

2. Choose a server, skill, prompt or setup and click Install for Claude Code or Codex. For a server, Cloak Proxy shows the command it will run (or the URL it connects to) and the vault items it will fill in; for a skill or prompt, every file’s text, with text an agent would run (!` commands and ```! blocks) and allowed-tools pointed out. Installing is your OK for exactly that version.

A definition Cloak Proxy can’t show in full (a field it doesn’t know, a value of another shape, a name given twice) can’t be installed or approved: Agents says why.

For a local (stdio) server, Cloak Proxy writes the agent’s config entry so that it starts cloakctl mcp-exec --team <team id> --space <space id> --server <id> --pin <hash>. For an http server, both Claude Code and Codex start cloakctl mcp-exec too, which connects to its URL for them. An http server’s URL must be https (plain http only for a server on this Mac), and redirects aren’t followed. That command looks up the definition in that one space and starts it only if it’s still the version you approved. It fills in the vault references that version names for the person running it, from their own team vault access and Keychain, and then starts the real server with those values. No secret value is written to ~/.claude.json or any other agent config file.

Your own MCP servers, skills and prompts are left alone: if one already has the name, installing stops and asks you to rename one of them. Skills go to ~/.claude/skills/<name>/ or ~/.codex/skills/<name>/, prompts to ~/.claude/commands/<name>.md or ~/.codex/prompts/<name>.md. Names starting with cloak-proxy are kept for Cloak Proxy’s own skills. There’s no Uninstall yet: to remove something you installed, delete its entry from the agent’s config, or its skill folder or prompt file. Deleting an item from the team, or leaving the team, doesn’t remove what’s already installed on your Mac (a server stops starting; a skill or prompt stays until you delete it).

If someone in the team changes a server you installed, it doesn’t start until you look at the change: Agents marks it Changed since you approved it and lists what changed, field by field for a server and file by file for a skill or prompt; Approve This Version (or Update) installs it. A server you change yourself is approved for you, if what you edited was the version you had approved; if a teammate’s change was still waiting for your review, it keeps waiting.

If you can’t open a vault item a server needs, it says so: “You don’t have access to team vault item STRIPE_KEY. Ask a manager of the ‘Staging’ folder.”

Related

Team vaultFolders, access and vault references.

MCP serverCloak Proxy's own MCP server.

Agent skills and setup toolsSkills for Claude Code and Codex.