MCP — connect a client to omg

omg has two MCP surfaces. They have different endpoints and different tools.

Hosted MCP for a cloud Computer

The canonical Streamable HTTP endpoint is:

https://mcp.omg.dev/mcp

The host also serves OAuth discovery at https://mcp.omg.dev/.well-known/oauth-protected-resource. The OAuth resource identifier is https://mcp.omg.dev. The resource identifies the service. The /mcp path identifies its Streamable HTTP endpoint.

The old origin-only endpoint remains a compatibility alias for MCP POST requests. New clients must use the canonical /mcp endpoint.

Connect from Claude Code

claude mcp add --transport http omg https://mcp.omg.dev/mcp

Then open Claude Code and ask it to call omg_status. The first tool call starts OAuth. Sign in to omg.dev, approve access, and return to the client. The client retries the call with its access token.

Hosted tools

The hosted MCP does not create or steer prompt-to-app builder runs. That product and its MCP tools are retired.

Connect from ChatGPT web

ChatGPT custom MCP apps must be configured on the web. They cannot be added from a mobile conversation.

1. Enable developer mode for your ChatGPT account or workspace.
2. Open Settings → Apps → Create.
3. Enter https://mcp.omg.dev/mcp as the endpoint.
4. Select OAuth authentication.
5. Select Scan Tools, then complete the omg.dev sign-in and consent flow.
6. Create the app.
7. For a Workspace Agent, attach the app and allow its actions in the agent builder.

ChatGPT Agent mode does not use custom apps. The hosted omg MCP also includes shell and delegation actions, so the ChatGPT plan and workspace policy must support full MCP actions. See OpenAI's current developer mode and MCP app documentation for availability and plan restrictions.

Local MCP for omg sessions

omg mcp talks to the local omg serve API on your machine. It exposes local session tools to an MCP client. It does not use mcp.omg.dev.

Install the control plane first:

curl -fsSL https://raw.githubusercontent.com/BennyKok/omg.dev/main/scripts/setup.sh | bash

Then open http://localhost:8766. lfg is an alias for the same command.

After omg is on PATH, register the local MCP server from the UI (Settings → Coding agents → Install MCP) or with a supported agent CLI. Setup does this automatically for Claude and Codex when those CLIs are already installed.

The local surface contains session, presentation, delegation, auto-agent, human-input, and catalog tools. Prefer its omg-managed delegation tools over a client's generic subagent helper. omg-managed child sessions remain visible in the UI and inherit the correct parent context.

Use omg.dev as the sign-in for your own MCP server

auth.omg.dev can be the OAuth 2.1 authorization server for an MCP server you host. Your users sign in with their omg.dev account and approve access on the omg.dev consent screen. Your server verifies the token and never handles passwords, codes, or sessions.

1. Publish protected resource metadata

Serve this document on your host. Use the path form when your MCP endpoint has a path. Clients try the path form first.

https://mcp.example.com/.well-known/oauth-protected-resource/mcp

{
  "resource": "https://mcp.example.com/mcp",
  "authorization_servers": ["https://auth.omg.dev"],
  "bearer_methods_supported": ["header"],
  "scopes_supported": ["api:write"]
}

2. Register the resource

Open Settings → Developer in the dashboard. Enter the resource URL, a name, and the scopes your server uses. Pick from api:read, api:write, and api:admin, and write one line for each. The consent screen shows your name and your lines. omg.dev fetches the metadata document to confirm that you control the host. Apps deployed with omg deploy on *.omgs.app are confirmed by ownership instead.

Tokens are bound to your resource URL (RFC 8707). A token for your server is not valid at any other resource, and a token for another resource is not valid at yours.

3. Verify tokens

• JWKS: https://auth.omg.dev/api/auth/jwks
• Algorithm: EdDSA
• Issuer: https://auth.omg.dev
• Audience: your resource URL, with or without a trailing slash
• Scope: the scope claim, space separated. api:admin implies api:write, which implies api:read.
• Identity: sub is the omg.dev user id. email and name are included.

Answer a missing or invalid token with 401 and this header, so MCP clients start the OAuth flow on their own:

WWW-Authenticate: Bearer resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource/mcp", scope="api:write"

Answer a token without the scope you need with 403 and error="insufficient_scope".

A helper that does all of this is available in @omg-dev/auth/resource-server:

import { createResourceServerAuth, ResourceAuthError } from "@omg-dev/auth/resource-server"

const rs = createResourceServerAuth({ resource: "https://mcp.example.com/mcp", scopes: ["api:write"] })

export async function POST(req: Request) {
  try {
    const who = await rs.authenticate(req, "api:write")
    // who.userId, who.email, who.scope
  } catch (err) {
    if (err instanceof ResourceAuthError) return rs.challengeResponse(err)
    throw err
  }
}

Client registration

Clients register with Dynamic Client Registration. A client that omits application_type and redirects to http://localhost:<port> is treated as a native app, which is what Claude Code sends.