Agent capabilities

The Capability Catalog keeps Agent Skills, MCP servers, and plugins in one place, and controls who can attach and use them.

Add a capability

Workspace owners and admins can open Settings → Capabilities. The workspace needs an active agent before the catalog is available. Workspace capabilities are included on every plan.

Open Add, then choose Add MCP, Add skill, or Add plugin. The menu opens the setup required for that source:

• MCP servers accept HTTP or STDIO settings. Import can also read a Git repository or pasted MCP configuration.
• Agent Skills come from a public GitHub repository. Select Review skills before choosing which skills to add.
• Plugins come from a Git repository containing a Claude Code plugin manifest or Agent Plugins 1.0 plugin.json.

Open the added entry to inspect its source, version, validation, permissions, and integrations. Approve the verified version, then set Who can attach or Who can use it under Access. A rejected version cannot be attached. Check for update inspects a newer source revision without replacing the approved version.

Authenticate an MCP server

An MCP server can require no authentication, a personal OAuth account, a personal token, a shared token, or a workspace environment variable. The available choices come from the server transport and its inspected authentication metadata.

Workspace owners and admins choose Authentication on the MCP details page. Shared tokens and environment-variable values are stored for the workspace. Each member connects their own OAuth account or personal token after the MCP is attached. Repository MCP credentials are personal tokens when the repository declaration requires one.

OAuth may require an administrator to save the workspace's client setup first. When a member selects Connect, the dashboard opens the provider sign-in in a new browser tab. Desktop sends the same flow to the system browser and waits for the member to return.

Authentication does not change who can attach the server. It determines which saved connection a run uses.

Attach it to an agent or step

Open an agent or worker and select Add in its Capabilities card. Codex agents can add Agent Skills and MCP servers. Claude Code and Cursor agents can also add plugins. OpenCode, Mistral Vibe, Hermes, Cline, DeepSeek Harness, and OMP run over ACP, which has no plugin mechanism; they take Agent Skills and MCP servers.

ACP agents receive a remote (HTTP or SSE) MCP server only when the agent says it supports that connection type. Otherwise One Horizon leaves the server out of the run and says so in the run activity. Mistral Vibe, for example, takes only local MCP servers.

In the workflow designer, select an agent step and choose Add beside Capabilities. Step pickers include skills, MCP servers, and plugins. The step inherits capabilities from its agent and worker, but it can also add a catalog capability directly.

Open a capability's options to make it required or optional, disable or enable it, or remove it from the level where it was added. A disable at any level wins for the run, and an inherited requirement cannot be weakened. Publishing rejects a capability that resolves to both required and disabled.

Web search for assistants

Every Edge Chat assistant starts with Web search · Built-in. It gives the assistant two read-only tools, and the assistant decides when to call them:

• web_search returns up to eight ranked results with a title, address, and short excerpts.
• web_fetch returns the text of one public page.

Search queries and page addresses are sent to an external search provider, which also fetches the page. One Horizon sends only the query or address the assistant wrote, with no conversation, workspace, or member details. Queries are limited to 400 characters, and web_fetch refuses local, private-network, and IP addresses.

Workspace owners and admins can turn web search off in two places:

• One assistant: open the assistant in Settings → Edge, open the options for Web search · Built-in, and choose Disable or Remove. Add a removed entry back from Add capabilities.
• The whole workspace: open Web search · Built-in in Settings → Capabilities and switch off Allow web search in this workspace. Assistants keep their own settings and get web search back when you switch it on again. While it is on, Who can attach limits web search to selected teams or members.

Choose where it loads in coding tools you start yourself

Repository assignments decide what Codex, Claude Code, and Cursor load when a developer starts the tool themselves, outside One Horizon. On a skill, MCP server, or plugin, open Repositories and choose:

• Everywhere: every session, including folders that are not GitHub repositories.
• Any GitHub repository: any GitHub repository. When the One Horizon GitHub App is connected, only repositories it can access.
• Selected repositories: only the repositories you pick. This needs the GitHub App.

Add Excluded repositories to withhold the capability from specific repositories. A saved repository the GitHub App can no longer reach is listed as renamed, moved, or access removed, and stops loading until you remove or replace it.

Each row in the catalog shows a repository icon; hover or focus it to see where the capability loads. To assign a whole group of skills at once, open the group's options and choose Assign all skills to repositories. Saving replaces any assignment the skills already had.

Select Preview a repository to check what a session started in one repository, or in a folder outside GitHub, receives and why the rest does not load.

Connect a coding tool

Open Settings → Integrations → Coding tools in One Horizon Desktop. Each tool shows its installed version and one status. Connect first lists the entries One Horizon adds to the tool's user settings, then adds them. Repair fixes entries after the One Horizon CLI moves, and Disconnect removes them. Entries you changed yourself are left as they are.

Desktop runs the One Horizon CLI for this, so the CLI must be installed and signed in. Outside Desktop, run one capabilities connect codex, claude, or cursor. A tool shows Not qualified yet until One Horizon has tested that tool version; Connect is unavailable until then.

Fix a blocked launch

When a required MCP server has a missing or unhealthy personal token, launch opens Connect or Reconnect. Save the token and the dashboard retries automatically. OAuth connections open the provider sign-in flow.

A Workspace credential problem or a Rejected version cannot be fixed by a member during kickoff. The dialog directs the member to a workspace admin, who can update the credential or approve a verified version in Settings → Capabilities.

Verify the session

Open a session and select Capabilities. Managed shows the workspace and repository capabilities resolved before launch. Observed local shows sanitized local declarations detected by the worker. Excluded explains which local capabilities were withheld and why.

If a retry observes different repository or local capabilities, the session reports the mismatch and keeps its original sealed manifest.

For the rest of the session timeline and recovery actions, see Monitoring.