---
title: Connect an AI Client to Thegram Cloud Safely
description: A practical guide to OAuth, mount discovery, cloud vaults, Drive, safe retrieval and revision-aware updates.
url: https://docs.thegram.one/ko/guides/cloud-agent-guide/
lang: en
requested_lang: ko
fallback_from: https://docs.thegram.one/guides/cloud-agent-guide/
tier: current
status:
  component: Thegram Cloud MCP
  deployment: Cloud service https://vault.thegram.one/mcp
  applies_to_version: Latest
  status: GA
  last_verified: "2026-10-25"
  owner: thegram-one/thegram-plugin; thegram-one/thegram-vault
  public_evidence:
    - https://thegram.one/llms.txt
    - https://thegram.one/download/releases/manifest.json
    - https://github.com/thegram-one/thegram-plugin
  rationale: The public endpoint and current cloud package are documented, but the guide’s claim of a 17-tool surface is not independently established by this fetched cloud-package release evidence.
source: https://docs.thegram.one/sources/cloud-agent-guide.gram
date_published: "2026-10-12T13:06:16.230Z"
date_modified: "2026-10-12T13:06:16.318Z"
evidence:
  Canonical source SHA-256: ced9a63cf345e56735644ef9906d396afc89b49295df44eb02c6e7a2488545d9
  Selected revision: r2 · sha256:8d6a59c66c488d4ffaae2652b24cf396e8fe81deabf5d5eb661a467e1898cca8
  Local renderer: configured local Thegram renderer · API thegram-web-render/1
  Core source: git+https://github.com/clab-one/thegram-format.git?rev=b16489e1d0d77d38f82d2f61776524737aa31557#b16489e1d0d77d38f82d2f61776524737aa31557
---

# Connect an AI Client to Thegram Cloud Safely

<div class="gram-doc-anchor" id="e0-blog-cloud-agent-guide"></div>

The cloud integration lets a supported AI client use Thegram memory through a remote MCP service. It is useful when people need shared project context without keeping a Mac app connected to every request. That connection does not mean an assistant can copy everything it reads: tool connection, data-source access and permission to save a particular fact are separate decisions. The steps below focus on making those boundaries visible.

### Connect and discover {#h0-3}

Start with [Quickstart](/guides/quickstart/) and [Cloud setup](/guides/cloud-setup/), then follow the official [agent installation instructions](https://thegram.one/install/agents.md) for the selected client. Complete its normal OAuth and authorization prompts. A plugin package, configured MCP connection, and host approval are distinct; package availability does not prove installation or authorization.

After connecting, call gram_projects to discover mounts. Use the exact key returned by the service, not its display name or a guessed identifier. A cloud-vault document uses a top-level path such as @mounts/\<vault-id\>/project.gram. Cloud vault writes are limited to top-level .gram documents; Google Drive mounts can expose folders. Respect the reported access level and the requested destination. A denied write is not a reason to copy the content to another mount.

First discovery can create a default writable vault for an account with none. That is account setup, not consent to create records or import content. A viewer cannot write. If an operation requires provider consent or authentication, ask the person to complete the normal authorization flow rather than attempting a workaround.

### Retrieve context before answering {#h0-7}

Start with gram_brief for the relevant document or folder. It reports current revisions and hashes, open work and an incremental changes cursor. Use gram_recall to find relevant records, then gram_context with only the fields needed to answer. Use gram_read for an outline or section and gram_relations when explicit links matter. Similar wording does not create a graph edge; only stored links do. Follow pagination and say when coverage is incomplete.

For later visits, pass the next cursor from gram_brief to gram_changes using since: next. The public plugin contract defines this as an exclusive recorded-time continuation, not a request for historical state. For a past state, request an explicit revision, recorded time or effective time. Distinguish when a fact applied from when it was recorded.

### Make careful, recoverable changes {#h0-10}

Before editing an existing document, take base_revision and expected_hash from the latest brief or a successful write response. Submit one intentional gram_patch with a stable request_id and typed operations. Give real tasks and risks appropriate statuses, place durable prose in its section and use source records for actual provenance. A record that is not placed may exist without appearing in the readable document. Do not invent owners, dates or evidence.

If a write reports STALE_REVISION or STORAGE_CONFLICT, read the current version, inspect affected prose and records, preserve other writers’ changes and construct a new intentional patch. Do not replay a stale patch unchanged. If a response is lost, inspect the destination before retrying; gram_create has no request ID, so check whether the document exists before another create. For Drive, claim remote persistence only when the response reports sync.state as synced. A successful tool call alone does not prove synchronization.

### Example: preserve a launch decision {#h0-13}

A product lead asks, “What did we decide about the staged launch, and what remains?” Discover the exact writable mount, brief the project document, recall rollout decisions and read relevant decision and task records with context. Answer first without writing. If asked to record an accepted exception, check the evidence, add one decision linked to its project and supporting evidence, place it in Decisions, and add a separate open task only if someone agreed that work remains. Read back the records and body; mention the revision and sync state only after checking the receipt.

### Limits and further reading {#h0-15}

The public plugin docs at revision 1f92e8a state that cloud semantic search is unavailable and recall mode auto falls back to keyword matching. This describes the cloud integration, not a live capability check; query gram_capabilities for the active service and do not assume local parity. The package implements MCP integration, not Slack or Gmail retrieval itself, although its shipped example prompt can ask an assistant to summarize connected sources. Server onboarding may describe broader automatic capture. Requiring the user’s explicit request before saving and reviewing the result are human operating guidance, not product-enforced consent controls.

Use [Cloud setup](/guides/cloud-setup/) for the current client flow and [Storage permissions](/reference/storage-permissions/) for mount paths, access levels, sync, and conflict handling. Check runtime capabilities before relying on a search mode or tool. Local project-folder hooks and app permissions belong to the separate local integration; cloud setup does not include them.

<div class="gram-record" id="e0-src-cloud-readme" data-record-type="source">

**Source:** thegram-cloud README

Public package overview, inspected at commit 1f92e8a.

Reference: [https://github.com/clab-one/thegram-plugin/blob/1f92e8a/README.md](https://github.com/clab-one/thegram-plugin/blob/1f92e8a/README.md)

</div>

<div class="gram-record" id="e0-src-cloud-contract" data-record-type="source">

**Source:** Committed cloud MCP contract

Public contract source at commit 1f92e8a, including the cloud semantic-search limitation and the gram_changes cursor behavior.

Reference: [https://github.com/clab-one/thegram-plugin/blob/1f92e8a/skills/thegram-cloud/references/contracts.md](https://github.com/clab-one/thegram-plugin/blob/1f92e8a/skills/thegram-cloud/references/contracts.md)

</div>

<div class="gram-record" id="e0-src-install-cloud" data-record-type="source">

**Source:** Official client installation guide

Public installation instructions; the client’s current authorization flow should be followed.

Reference: [https://thegram.one/install/](https://thegram.one/install/)

</div>

<div class="gram-record" id="e0-src-vault-contract" data-record-type="source">

**Source:** Vault service implementation contract

Internal Vault source reviewed at revision a193a19; not publicly available.

</div>

<div class="gram-record" id="e0-knowledge-cloud-destination" data-record-type="knowledge">

**Knowledge:** Preserve the requested mount

Use exact mount keys and never redirect a failed write to another destination.

</div>

<div class="gram-record" id="e0-knowledge-cloud-recovery" data-record-type="knowledge">

**Knowledge:** Read back and reconcile writes

After authorized cloud or Drive changes, inspect the relevant records and check reported synchronization state.

</div>

<div class="gram-record" id="e0-knowledge-cloud-search" data-record-type="knowledge">

**Knowledge:** Check current cloud search behavior

Public cloud docs state semantic search is unavailable and auto falls back to keyword matching; verify live capabilities.

</div>
