MCP

Connect Claude Code, Codex, OpenCode, L0 Nexus, and L0 Tools with app-supplied endpoints and tokens.

Labor0 MCP setup is workspace-scoped. Copy real endpoints, metadata URLs, and snippets from the authenticated app after choosing the workspace. Public examples use placeholders only.

Project-level Runner MCP setup is separate from local client setup. Use it when you want Labor0 runner sessions for one project to start with extra remote MCP servers already attached.

What to copy from the app

Open the workspace, then use the L0 Nexus or L0 Tools area to copy:

active workspace endpoint URL
protected-resource metadata URL
authorization-server metadata URL
authentication snippet
Claude Code, Codex, or OpenCode setup snippet
optional project or model headers when the app shows them

Use shared notes for shape and process only. Keep actual route tokens, workspace IDs, and bearer-token values in the authenticated app or your local secret manager.

Project Runner MCP servers

Project Runner MCP servers are configured from Project Settings > Runners.

Use this flow when hosted or local runner sessions for a specific project should start with additional remote MCP servers already attached. This is different from adding an MCP server directly to your own local Codex, Claude Code, or OpenCode config.

What Project Runner MCP supports

public https:// MCP endpoints only
no stdio commands or local process launch
no localhost, RFC1918 private network, link-local, loopback, or plain http:// targets
optional no-auth access, write-only static headers, or shared OAuth
manual preview before using the server in runner sessions
audit history for server changes and previews, with OAuth connection lifecycle owned by the Labor0 authorization Hub

Hosted runners must be able to reach the endpoint from the public internet. If you need a machine-local server, private subnet access, or a process started from your workstation, use a local runner and configure that MCP server on the machine itself instead of in project Runner MCP settings.

Add a Project Runner MCP server

Open the project in the app, then go to Project Settings > Runners > Runner MCP servers.

For each server, enter:

a stable server key
a human-readable display name
the public HTTPS endpoint URL
an optional description
an authentication mode: None, Static headers, or OAuth
whether the server is enabled for future sessions

Saved static header values and any OAuth client secret entered during Hub connection setup are write-only and are not shown again. Project Runner MCP settings store server metadata and reference the resulting authorization connection; OAuth grants remain in the authorization Hub.

Authentication modes

None is appropriate only for public endpoints that do not require credentials.

Static headers lets you attach fixed request headers such as API keys or vendor bearer tokens. Header names must be valid HTTP header names and each header name must be unique. Existing stored values remain blank during editing so you can preserve them without re-entering the secret.

OAuth lets the project share one Hub-managed MCP authorization connection for runner sessions. Use Connect OAuth the first time, then Reconnect OAuth if the connection expires, is revoked, or preview reports reconnect required. Reconnect keeps the same connection identity while the Hub replaces its authorization material.

Preview and rollout behavior

Use Preview after creating or editing a server. Preview checks that the endpoint is reachable and lists the tools, prompts, and resources the server exposes. It does not call tools.

Preview status stays attached to the saved server:

Not previewed means no manual preview has completed yet
Preview succeeded means Labor0 reached the endpoint and listed capabilities
Preview failed or Preview timed out means the endpoint or auth needs attention
Reconnect required means the Hub authorization connection must be reconnected before Labor0 can use it

Project Runner MCP changes apply to future sessions only. Active runner sessions keep the MCP descriptor set they started with, so create a new session after enabling, disabling, editing, or reconnecting a server.

Audit history

The same project settings screen shows Runner MCP server audit history. Use it to confirm recent create, update, delete, preview, enable, disable, and bootstrap outcomes without exposing stored header values or brokered credentials. Authorization lifecycle audit remains with the Labor0 authorization Hub.

Where these servers appear

Project Runner MCP servers are injected into Labor0 runner sessions for that project:

hosted runners use them automatically when the endpoint is public and enabled
local runners also receive them for new sessions, but the endpoint still needs to be reachable from the machine running labor0-runner
Codex, Claude Code, and OpenCode inside those runner sessions can use the injected server set without extra per-session setup

This does not add the server to your personal local CLI config outside Labor0. If you want the same MCP server in your own standalone Codex, Claude Code, or OpenCode environment, configure it separately in that client.

Labor0 token

Most local MCP clients use a Labor0 user API token:

export LABOR0_TOKEN="<Labor0 token>"

Create the token from workspace token settings. Prefer environment variables over command-line token values so shell history does not capture the secret.

L0 Nexus

L0 Nexus is the workspace MCP endpoint for knowledge retrieval and guarded data queries. For Codex, the app currently provides the bearer-token environment variable pattern:

codex mcp add l0-nexus \
  --url "<workspace_mcp_endpoint_url>" \
  --bearer-token-env-var LABOR0_TOKEN
codex mcp list

Use the exact endpoint and snippet from the app. Do not use codex mcp login unless the app explicitly provides an OAuth-based snippet for that runtime.

Common L0 Nexus tools include:

Tool	Purpose
`knowledge.list_sources`	Lists active workspace knowledge sources visible to the caller.
`knowledge.search`	Searches indexed workspace knowledge with source attribution.
`knowledge.get_document`	Opens an authorized document from the returned workspace corpus.
`data.list_bindings`	Lists active data bindings visible to the caller.
`data.query.read`	Runs read-only data operations within app-configured safety limits.
`data.query.write`	Runs write-capable operations only when both binding and caller allow it.

L0 Tools

L0 Tools exposes workspace authoring surfaces such as Figma, Google Workspace, and Office documents. The app renders current per-surface URLs and client snippets.

Example endpoint shape:

https://l0-tools-mcp.api.labor0.com/mcp/workspaces/{workspace_id}/figma

Replace {workspace_id} only with the value shown in the authenticated app.

Suggested local server names and endpoint paths:

Surface	Suggested server name	Endpoint path
Figma	`l0-tools-figma`	`/mcp/workspaces/{workspace_id}/figma`
Google Docs	`l0-tools-gws-docs`	`/mcp/workspaces/{workspace_id}/gws/docs`
Google Sheets	`l0-tools-gws-sheets`	`/mcp/workspaces/{workspace_id}/gws/sheets`
Google Slides	`l0-tools-gws-slides`	`/mcp/workspaces/{workspace_id}/gws/slides`
Google Forms	`l0-tools-gws-forms`	`/mcp/workspaces/{workspace_id}/gws/forms`
Office DOCX	`l0-tools-office-docx`	`/mcp/workspaces/{workspace_id}/office/docx`
Office PPTX	`l0-tools-office-pptx`	`/mcp/workspaces/{workspace_id}/office/pptx`
Office XLSX	`l0-tools-office-xlsx`	`/mcp/workspaces/{workspace_id}/office/xlsx`

Claude Code

Use the app-provided JSON snippet. The public shape is:

export LABOR0_TOKEN="<Labor0 token>"
claude mcp add-json l0-tools-figma \
  '{"type":"http","url":"<l0_tools_surface_url>","headers":{"Authorization":"Bearer ${LABOR0_TOKEN}"}}'
claude mcp list

Keep the JSON in single quotes in POSIX shells so the token value is not substituted while adding the server.

Codex

Use the bearer-token environment variable pattern:

export LABOR0_TOKEN="<Labor0 token>"
codex mcp add l0-tools-figma \
  --url "<l0_tools_surface_url>" \
  --bearer-token-env-var LABOR0_TOKEN
codex mcp list

OpenCode

Use the app-provided config snippet. The public shape is:

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "l0-tools-figma": {
      "type": "remote",
      "url": "<l0_tools_surface_url>",
      "enabled": true,
      "oauth": false,
      "headers": {
        "Authorization": "Bearer {env:LABOR0_TOKEN}"
      }
    }
  }
}

Troubleshooting

Start with safe checks:

the selected workspace is correct
for Project Runner MCP, the selected project is correct
LABOR0_TOKEN is set in the same shell that starts the client
the endpoint was copied from the current app screen
the MCP route is active, not revoked
the connector, source, or data binding is active in the app
the caller has access to the project or workspace being queried
hosted Runner MCP endpoints use public https:// and are not localhost, private IP, or plain http://
static headers were saved before leaving the editor, because the values are write-only after save
OAuth-based Runner MCP servers have an active shared Hub authorization connection and do not show Reconnect required
after changing Project Runner MCP settings, start a new runner session so the updated server set is picked up

Do not paste real tokens, private endpoint values, source document bodies, database connection strings, or private tool results into public support threads.

Read Getting started for workspace setup.
Read Concepts for how MCP fits into app workflows.
Read Local runners when a project needs private-network or machine-local MCP access.

MCP