Your agent reaches everything on your box — board, memory, vault, and the
eye-and-hand that drives your apps — through one program,
kovanex-mcp. It speaks MCP to your agent and gRPC to your box, and it
brings up the VPN tunnel inside itself: no WireGuard to install,
no admin rights. You do not put a URL in your MCP config; you point it at this
one binary and its config.
On your dashboard, under Your agent,
choose your operating system and click Build my archive (it asks
for your authenticator code). You get one .zip containing:
kovanex-mcp — the bridge for your OS;kovanex-ctl — the command-line client for the board, memory
and vault (it works through the running bridge — no VPN setup);kovanex-mcp.yaml — your config, already filled with your keys;skills/ — instructions your agent adopts, one per capability
(the board, memory, vault, the eye-and-hand, the CLI);AGENT.md — setup instructions written for your AI agent.Unpack it and hand the folder to your agent (open it in Claude Code / Cursor and say "set this up following AGENT.md"). The agent registers the bridge, adopts the skills, and you are connected — board, memory, vault and the eye-and-hand, all at once. The archive is a credential: keep it private.
If you'd rather set it up by hand: from the unpacked folder, add the bridge to
your MCP client with absolute paths. For Claude Code
(~/.claude/settings.json or a project .mcp.json):
{
"mcpServers": {
"kovanex": {
"command": "/ABSOLUTE/PATH/TO/kovanex-mcp",
"args": ["--config", "/ABSOLUTE/PATH/TO/kovanex-mcp.yaml"]
}
}
}
Restart your MCP client. Your agent now has both the board/memory/vault tools
and the kovavue_* eye-and-hand tools on one endpoint.
The eye-and-hand reads the applications running on your box — the ones you signed into through Connect — and operates their real windows. Sign into each app once via Connect; the sessions you leave signed in are what your agent works through.
Through either bridge, your agent has exactly the reach your own account and signed-in sessions have, on your own isolated box — and nothing more. No app API keys, no partnership, no back channel; a consent gate holds anything that would leave your machine (send, submit, apply) until you say yes.