# External assistants through MCP

> Connect an assistant to project telemetry, shared investigations, and coding handoffs.

Connect an external assistant to Radiant’s MCP server so it can investigate your project’s recorded activity. The credential determines which project it can read and whether it can manage Signals, read shared investigations or continue a coding handoff.

This is separate from exporting the assistant’s own traces and from [connecting external tools to Meta Agent](/docs/platform/meta-agent/connected-tools-and-approvals.md).

## Create a project credential

Select the project the assistant should access. An owner or admin opens **Settings → Project settings → API keys**, then chooses **Create credential** under **MCP credentials**. Name the client and select the authority it needs:

| Access                                         | What the assistant can do                                                               |
| ---------------------------------------------- | --------------------------------------------------------------------------------------- |
| Base access                                    | Read project telemetry, observations, and Signals.                                      |
| Manage Signals (`can_manage_signals`)          | Create, activate, and deactivate Signals.                                               |
| Read conversation history (`can_read_history`) | Search and read shared Meta Agent conversations. Private conversations remain excluded. |
| Coding handoffs (`can_coding_handoffs`)        | Claim a prepared task, ask Meta Agent follow-up questions, and report its outcome.      |

Handoff questions use the tool authority of the participant who prepared the handoff, including permitted external actions; see [Coding handoffs](/docs/platform/meta-agent/coding-handoffs.md#ask-follow-up-questions). This capability is independent of direct conversation-history access.

Create the credential and store the secret immediately in the client’s secret manager or private environment. It is shown only once. Capabilities are fixed at creation; create a replacement credential when a client needs different authority.

## Configure the client

Use the origin of your Radiant dashboard followed by `/mcp`. For example, if you open a project at `https://radiant.example.com/projects/PROJECT_ID/logs`, the MCP URL is `https://radiant.example.com/mcp`. The project path is omitted because the credential identifies the project.

Add that URL as a **Streamable HTTP** server in your MCP client. The credential-creation dialog provides an **Authorization header** to copy: `Authorization: Bearer YOUR_MCP_CREDENTIAL`. Store the credential in the client’s private environment or secret manager.

For Codex, add the following to `~/.codex/config.toml` and set `RADIANT_MCP_CREDENTIAL` in the environment that launches it. The variable’s value is the token alone, without the `Bearer `prefix:

**\~/.codex/config.toml**

```toml
[mcp_servers.radiant]
url = "https://YOUR_RADIANT_HOST/mcp"
bearer_token_env_var = "RADIANT_MCP_CREDENTIAL"
```

Replace the URL with the dashboard origin described above. See [Codex MCP configuration](https://learn.chatgpt.com/docs/extend/mcp) or [Claude Code’s HTTP server setup](https://code.claude.com/docs/en/mcp#option-1-add-a-remote-http-server) for the client’s configuration and connection controls.

Each credential addresses one project. Tools cannot select another project by ID; create a separate credential and client connection when you need another project’s data.

## Check the connection

Refresh the client’s available tools and ask it to inspect a trace you can identify in Logs, for example:

> Use Radiant to inspect trace TRACE_ID. Summarize the recorded model requests and tool calls, and cite the spans supporting your answer.

Replace `TRACE_ID` with a real identifier and compare the returned records with Logs. The [MCP tool reference](/docs/platform/reference/mcp-tools.md) describes available tools, query bounds, and pagination.

A `401` indicates that authentication failed. Check the configured MCP token, including whether it expired, was revoked or changed during rotation. An ingestion key authorizes trace export rather than MCP access. Follow [API keys and credentials](/docs/platform/administration/api-keys-and-credentials.md) to replace or revoke access.

For a coding task prepared in an investigation, continue with [Coding handoffs](/docs/platform/meta-agent/coding-handoffs.md).