Agent capabilities

The Capability Catalog keeps Agent Skills, MCP servers, and plugins in one place. The shortest path is to add a capability, authenticate it when required, attach it to an agent or workflow step, then verify the session.

Add a capability

Workspace owners and admins can open Settings → Capabilities. The workspace needs an active agent before the catalog is available. Workspace capabilities are included on every plan.

Open Add, then choose Add MCP, Add skill, or Add plugin. The menu opens the setup required for that source:

• MCP servers accept HTTP or STDIO settings. Import can also read a Git repository or pasted MCP configuration.
• Agent Skills come from a public GitHub repository. Select Review skills before choosing which skills to add.
• Plugins come from a Git repository containing a Claude Code plugin manifest or Agent Plugins 1.0 plugin.json.

Open the added entry to inspect its source, version, validation, permissions, and integrations. Approve the verified version, then set Who can attach or Who can use it under Access. A rejected version cannot be attached. Check for update inspects a newer source revision without replacing the approved version.

Authenticate an MCP server

An MCP server can require no authentication, a personal OAuth account, a personal token, a shared token, or a workspace environment variable. The available choices come from the server transport and its inspected authentication metadata.

Workspace owners and admins choose Authentication on the MCP details page. Shared tokens and environment-variable values are stored for the workspace. Each member connects their own OAuth account or personal token after the MCP is attached. Repository MCP credentials are personal tokens when the repository declaration requires one.

OAuth may require an administrator to save the workspace's client setup first. When a member selects Connect, the dashboard opens the provider sign-in in a new browser tab. Desktop sends the same flow to the system browser and waits for the member to return.

Authentication does not change who can attach the server. It determines which saved connection a run uses.

Attach it to an agent or step

Open an agent or worker and select Add in its Capabilities card. Codex agents can add Agent Skills and MCP servers. Claude Code, Cursor, and OpenCode agents can also add plugins.

In the workflow designer, select an agent step and choose Add beside Capabilities. Step pickers include skills, MCP servers, and plugins. The step inherits capabilities from its agent and worker, but it can also add a catalog capability directly.

Open a capability's options to make it required or optional, disable or enable it, or remove it from the level where it was added. A disable at any level wins for the run, and an inherited requirement cannot be weakened. Publishing rejects a capability that resolves to both required and disabled.

The full workflow editing flow is covered in Workflows.

Fix a blocked launch

When a required MCP server has a missing or unhealthy personal token, launch opens Connect or Reconnect. Save the token and the dashboard retries automatically. OAuth connections open the provider sign-in flow.

A Workspace credential problem or a Rejected version cannot be fixed by a member during kickoff. The dialog directs the member to a workspace admin, who can update the credential or approve a verified version in Settings → Capabilities.

Verify the session

Open a session and select Capabilities. Managed shows the workspace and repository capabilities resolved before launch. Observed local shows sanitized local declarations detected by the worker. Excluded explains which local capabilities were withheld and why.

If a retry observes different repository or local capabilities, the session reports the mismatch and keeps its original sealed manifest. This preserves the evidence used for the run instead of silently replacing it with the retry's environment.

For the rest of the session timeline and recovery actions, see Monitoring.