Skip to content
Jithox
Sign in

Connect Jithox · terminal

Connect the AI you already use to Jithox with one command

The Connect Kit detects Claude Code, Codex CLI, Gemini CLI or Cursor, shows the exact change it would make, asks first, backs up, writes only the Jithox block, and tells you how to undo it. Your client then signs in itself with OAuth — you approve the scopes on jithox.com — so no credential ever sits in a file. Nothing is downloaded, nothing runs without your yes.

Copy the command and run it in a terminal. Node 20 or newer is all it needs.
npx jithox connect

1 · Install and run

One command; npx fetches the kit and runs it. It detects your client and shows the plan before anything happens. Then you sign in securely with OAuth: the client opens jithox.com, you approve which checks it may use, and the client keeps its own short-lived tokens.

npx jithox doctor
npx jithox connect
npx jithox auth login

No download and no account for the doctor and the preview. Signing in needs your Jithox account, nothing else.

2 · What it changes

Only the jithox block in the configuration file your client already reads — and with OAuth that block is just the endpoint. Everything else — other servers, comments, order, indentation — stays byte for byte.

  • Claude Code: ~/.claude.json → mcpServers.jithox, then `claude mcp login jithox`
  • Codex CLI: ~/.codex/config.toml → [mcp_servers.jithox], then `codex mcp login jithox`
  • Gemini CLI: ~/.gemini/settings.json → mcpServers.jithox, then `/mcp auth jithox`
  • Cursor: .cursor/mcp.json in the project, or ~/.cursor/mcp.json, then “Needs login”
  • Claude Desktop and any other MCP client: the endpoint; the client signs in when it asks
  • Any HTTP agent: `npx jithox auth login` gives a ten-minute token that refreshes itself
  • Compatibility fallback — less recommended: a static connection credential from your account page (`--auth static`), stored in ~/.jithox/connection, readable by you only
Endpoint
https://jithox.com/api/agent-connection/v1/mcp

3 · Preview first

Before anything is written you see the client, the file, the server name, the endpoint, the authentication method (OAuth by default), the scopes, the files that change, the backup path, the test that follows and the rollback command — then a diff. With OAuth the diff holds no secret at all.

CLIENT            Gemini CLI
CONFIG_PATH       ~/.gemini/settings.json
SERVER_NAME       jithox
ENDPOINT          https://jithox.com/api/agent-connection/v1/mcp
AUTH_METHOD       OAuth 2.1 — the client signs in itself (Authorization Code + PKCE S256); no credential in any file
REQUESTED_SCOPES  tools:discover
FILES_CHANGED     ~/.gemini/settings.json
BACKUP_PATH       ~/.gemini/settings.json.jithox-backup-<timestamp>
TEST_AFTER_WRITE  initialize; tools/list; sign-in accepted (nothing executed)
ROLLBACK_COMMAND  npx jithox disconnect --client gemini

Apply this Jithox connection? [y/N]

The default answer is No. There is no --yes for anything that stores a credential, signs out or could cost money.

4 · Test

After the write the kit runs initialize and tools/list, then one probe that proves your sign-in is accepted without executing or charging anything. Every failure names a recovery. The status line says what was actually proven:

npx jithox test
CONFIG_VALIDATED
the file is right; the gateway was not reached with a sign-in
OAUTH_FLOW_TESTED
the sign-in flow ran against the lab's provider
RUNTIME_TESTED
the gateway accepted the sign-in on this machine
FIXTURE_ONLY
the local sandbox, never production

5 · Undo

disconnect removes only the jithox block (backup first) and checks what the gateway now answers. auth logout revokes your sign-in at jithox.com, deletes the local tokens and proves the old token is dead. --restore puts any earlier backup back.

npx jithox disconnect
npx jithox auth logout

One thing only a person does

Revoking a connection is also always possible on the account page; one revoked client never breaks another. Account page

What the kit never does

  • No token or credential is ever an argument, in shell history, printed, in logs or crash output, in a backup, or sent anywhere but jithox.com.
  • No purchase, no top-up, no paid call, no automatic retry, no wider rights than you approved.
  • No file is overwritten whole; no symlink is followed; no file of another user is touched.
  • No telemetry.

Developer details

Which clients · For agents

Claude Code, Codex CLI, Gemini CLI and Cursor sign in with OAuth themselves. Claude Desktop connectors do too. Plain HTTP agents use the kit's own sign-in. Each one is marked with what was actually tested; nothing is called certified without a real run against production.

npx jithox connect --prepare --client <client> --json writes nothing, needs no sign-in and returns the plan: the proposed changes with a diff, the owner action required, the permissions, the rollback plan, a hash and an expiry. Hand it to a person; the person runs connect and signs in.

npx jithox connect --prepare --client <client> --json
LOCAL_SIMULATION · NOT_PRODUCTION · NO_REAL_DATA · NO_REAL_CHARGE
npx jithox connect --sandbox
Compatibility fallback — less recommended
npx jithox connect --auth static

Signing in and approving the scopes on the Jithox consent screen. The kit never automates a browser and never creates a connection by itself. The static credential path (compatibility fallback) also needs a person to create the credential on the account page. Your connections on the account page

Developer quickstart · What should your AI do?