# Connect Asklear

Preserve the user's original task before changing MCP configuration.

This setup requires the exact asklear entry and https://api.asklearai.com/mcp URL. Never substitute another existing MCP connection, even if it reports connected.

Inspect any existing asklear MCP entry before adding one and apply existing_connection_policy. A matching URL alone is not sufficient: static API-key credentials must be removed from a personal Agent entry so the client starts OAuth.

If the existing asklear entry points to a different URL, explain the environment change and ask the user before replacing it.

Connect the remote MCP URL using the client's standard MCP flow.

Detect the current Agent client and follow only its matching client hint; do not guess another client's menu names.

If authentication is required, let the client's native OAuth action open the official Asklear page. Do not also open the same authorize URL manually. Open a URL yourself only when the client explicitly cannot launch it, and only once.

When a tool returns human_action, open its official URL, wait for the user, and follow its resume policy without losing the original task.

After authorization, verify connection_status reports server_name=asklear and mcp_url=https://api.asklearai.com/mcp, then continue the user's original task.

Ask the user to perform only client-native trust, login, authorization, or payment actions that the Agent cannot perform. Do not end Setup merely to ask the user to reply that authorization is complete; monitor or re-check the connection when the client supports it.

Never ask the user to copy or paste a Asklear API key for this personal Agent setup.

MCP URL: https://api.asklearai.com/mcp

## Existing connection migration

- Same name and same URL with a working OAuth connection: reuse it and do not reauthorize.
- Same name and same URL with a static Authorization header, API-key environment field, or other long-lived bearer credential: update that entry in place by removing only static credential fields, then use standard MCP OAuth. Never print or copy the old credential.
- Apply in-place credential removal only to the current interactive client's personal connection. Never mutate repository, project-shared, CI, service-account, or enterprise-managed credentials; preserve those integrations and create a separate personal OAuth connection, asking the user to resolve any name collision.
- Same name with a different URL: show only the old and target origins, explain the environment change, and obtain user approval before replacing it.
- Different name with the same target URL: create or verify the canonical asklear entry first; only after it connects, ask before disabling or removing the old alias.
- Never modify unrelated MCP entries and never revoke an existing API key automatically; key revocation is a separate explicit user action.

## Client-specific setup

### Codex
- Inspect the existing asklear entry without printing credential values. If its URL matches but it has static Authorization/http_headers, remove only those static credential fields, keep the URL, then run OAuth login.
- codex mcp add asklear --url https://api.asklearai.com/mcp
- codex mcp login asklear
- The Codex login command owns browser launch and callback handling. Never run open/xdg-open or manually reopen an authorize URL when login already launched or completed it. Open a returned URL manually only if Codex explicitly reports that automatic browser launch failed, and do so once.

### Claude Code
- Inspect the existing asklear entry without printing credential values. If its URL matches but it has headers.Authorization, replace that entry in place with URL-only HTTP MCP configuration before opening /mcp.
- claude mcp add --transport http asklear https://api.asklearai.com/mcp
- Open /mcp, approve the asklear server if prompted, and complete browser authentication.

### WorkBuddy
- Inspect the existing asklear entry in WorkBuddy's MCP configuration without printing credential values. If the URL matches but the entry contains headers.Authorization, env API-key fields, or another static bearer credential, remove only those credential fields and keep the entry as URL-only streamable HTTP MCP. Preserve every unrelated MCP entry.
- If no asklear entry exists, add it with the exact URL above. If the same name points to a different URL, ask the user before replacing it.
- Tell the user exactly: open Connectors in the left navigation → Custom Connector in the upper-right → find asklear → click Trust, then keep it enabled. Do not invent alternate menu paths.
- After Trust opens the browser, let the user complete Asklear registration/login and authorization. Then re-check the connector and continue the original task without asking the user to reply "authorized".