---
title: OAuth and API-key agent connections
description: ChatGPT, Claude and coding agents use the same Cloud MCP with different authentication and host adapters, not a required local Mac proxy.
url: https://docs.thegram.one/ko/architecture/plugin-architecture/
lang: en
requested_lang: ko
fallback_from: https://docs.thegram.one/architecture/plugin-architecture/
tier: current
status:
  component: OAuth connector and coding-agent plugin
  deployment: Cloud MCP https://vault.thegram.one/mcp
  applies_to_version: Latest
  status: GA
  last_verified: "2026-10-25"
  owner: thegram-one/thegram-mcp; thegram-one/thegram-plugin
  public_evidence:
    - https://thegram.one/install/agents.md
    - https://github.com/thegram-one/thegram-plugin
  rationale: Current public setup routes coding API keys and ChatGPT/Claude OAuth to the same Cloud MCP. The app-mediated local integration in the prior capture is historical, not a fallback.
historical_source: https://docs.thegram.one/sources/plugin-architecture.gram
editorial_sources:
  - https://thegram.one/install/agents.md
  - https://github.com/thegram-one/thegram-mcp
  - https://github.com/thegram-one/thegram-plugin
---

# OAuth and API-key agent connections

<div class="gram-doc-anchor" id="e0-blog-plugin-architecture"></div>

## OAuth clients {#h0-3}

ChatGPT and Claude use their provider’s OAuth connection to `https://vault.thegram.one/mcp` over Streamable HTTP. The person signs in and reviews the intended resources. A custom connector exposes tools; a packaged skill supplies additional memory workflow guidance. Neither action alone proves the other is installed or authorized.

See [ChatGPT and Claude setup](/guides/cloud-setup/). A custom/private route is not an approved public directory listing.

## Coding-agent API keys {#h0-7}

Claude Code, Codex, OpenCode and OMP use the shared coding plugin and a person-issued, scoped API key against the same Cloud MCP. The plugin provides host adapters and repository-context behavior. It does not need a running Mac application or a local MCP socket.

The current adapter searches accessible Vault documents for exactly one existing project record with the repository tag. Missing or duplicate associations stop; selected-vault defaults and fixed local document mappings do not choose a destination. Follow [coding setup](/guides/local-setup/) for the canonical commands and an explicitly authorized association to an existing document.

## Discover capabilities and verify reads {#h0-10}

Use live capability/tool discovery rather than a historical capture to decide which operations are available. List the connection’s actual permitted spaces and use exact returned keys and document paths. Report indexing delays or a returned keyword fallback rather than implying a semantic search guarantee.

A successful connection check does not need a write. Empty or denied results must be reported as such; do not create a replacement document, change accounts or switch destinations to hide a problem.

## The same service does not mean the same authority {#h0-13}

OAuth grants, API-key resource scopes, Vault membership and organization policy bound access. Drive access is separately authorized and local-only files are not uploaded automatically. A technical write grant still needs the person’s approved purpose, content and destination. See [permissions](/guides/permissions/).

The prior source described a Mac-app proxy, local folder mappings and an earlier tool/search contract. That captured publication remains historical evidence, not current setup. Old record links below lead to this explanation; the exact historical records remain in the downloadable `.gram` source.

<span id="e0-src-cloud-plugin"></span><span id="e0-src-local-plugin"></span><span id="e0-src-vault-service"></span><span id="e0-src-agent-install"></span><span id="e0-src-cloud-contract"></span><span id="e0-knowledge-integration-boundaries"></span><span id="e0-knowledge-search-limit"></span><span id="e0-knowledge-consent-limit"></span>