# Connecting an AI agent

Answers the question: How do you give an AI agent access to the fleet?

## The agent key

The Agents section issues keys for machine clients. A key opens the MCP interface at the Wyrd server's address, path `/mcp`. It does not open the console, and an administrator's sign-in does not open the MCP interface.

![Agent keys](https://docs.wyrd.link/assets/img/en/console-agents.png)

Rights are chosen when the key is issued: read, configure, destructive. Every key reads. By default a key lives 90 days.

The «Full access, no term» box issues a key that reaches everything an administrator reaches in the console.

The key is shown once. It is revoked with the button in the list.

If the Wyrd server is installed on your side, the first key can also be issued on the machine itself, which spares the agent the administrator's password:

```
sudo -u wyrd wyrd -c /etc/wyrd/wyrd.toml --issue-key assistant
```

The server does not have to be stopped for it. Without `--key-classes` and `--key-days` the key gets full access and no term.

## What the agent reaches

The agent reaches everything an administrator handles in the console: the fleet and each device's page, policies, groups, zones and geofences, programs, the managed configuration of each application on each handset, alert rules, accounts, agent keys, kiosk screens, licenses, updates and commands to handsets. An application is uploaded in the same call, the file travelling in its body.

The agent reads logs as a slice: device, stream and number of last lines.

## Setting up the agent

The agent calls `/mcp` with POST and presents the key in a header:

```
Authorization: Bearer wyrd_mcp_…
```

A key carries out at most ten destructive actions an hour.

## The call journal

Agent calls are recorded in the Agents section: time, key, tool, device and outcome. Refusals go into the journal alongside what went through.

## Getting acquainted and a demonstration

A separate interface answers at wyrd.link/mcp without a key: it describes the product and hands out a demonstration stand. A stand handed to an agent takes no phones. A stand taken by hand at demo.wyrd.link takes phones.

A stand lives until its lease runs out, and it can be ended sooner – with the button on the page or a call from the agent interface. The server, its database and everything put on it are wiped for good, and the password stops working.

## The path without a browser

The wyrd.link/mcp interface takes an agent from an account to a paid license.

1. It opens a cabinet account. The identifier, the password and the cabinet key come back once, and the first thing the agent does is hand them to the person.
2. It picks an offer and requests payment. A manager confirms it; their contact comes back with the request. The license key is issued after that confirmation.
3. It writes to support and reads the answer.
4. If the server is to run on your machine, it files an On-Premise request and, once agreed, takes the install plan.

The cabinet key and the agent key are different things. The first opens wyrd.link/mcp and concerns the account; the second opens the Wyrd server's MCP and concerns the fleet.