> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/guides/ai-agents/connect-mcp.md).

# Connect an AI client with MCP

Add the Devolutions CLI MCP server to Claude Code, GitHub Copilot, or another MCP client, and understand what the model can see and do.

`devo mcp` turns Devolutions CLI into a Model Context Protocol (MCP) server. Your AI client starts it, and the model gets tools to work on your workspace: list vaults, search entries, review access, generate passwords, and more. It's the same workspace and the same permissions as the `devo` commands you run yourself.

## Before you start

* Devolutions CLI is installed, and the `devo` command is on the `PATH` of the AI client.
* You're signed in. The MCP server has no sign-in tool: it uses the contexts you saved with `devo login`, starting with your current one. See [Connect to your workspaces](/cli/guides/connect.md).
* Your MCP client can start a local server over standard input and output (stdio), which most clients do.

{% hint style="warning" %}
The MCP server can return a secret value to your AI client, through the `RDM_resolve_secret_reference` tool. Anything the client receives can reach the model and its transcript. If the model doesn't need values, start the server with `--deny-tool RDM_resolve_secret_reference`. See [Limit what an agent can do](/cli/guides/ai-agents/limit-tools.md).
{% endhint %}

## Add the server to your client

Most MCP clients describe a local server with a command and its arguments. Add an entry like this one to your client's MCP configuration:

```json
{
  "mcpServers": {
    "devolutions": {
      "command": "devo",
      "args": ["mcp", "--deny-tool", "RDM_resolve_secret_reference"]
    }
  }
}
```

The key that holds the servers (`mcpServers` here) and the file where it goes depend on your client. Check your client's documentation for where to add a local stdio server.

Restart the client or reload its MCP servers. The client starts `devo mcp` itself and stops it when the session ends: you don't run it in a terminal.

### Options you can add

<table><thead><tr><th width="260">OPTION</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--context &#x3C;context-name></code></td><td>Uses this saved context instead of your current one. Useful when the agent must work on one workspace only.</td></tr><tr><td><code>--read-only</code>, <code>--deny-destructive</code>, <code>--deny-open-world</code>, <code>--allow-tool</code>, <code>--deny-tool</code></td><td>Restrict the tools the model gets. See <a href="/cli/guides/ai-agents/limit-tools.md">Limit what an agent can do</a>.</td></tr><tr><td><code>--server-name &#x3C;name></code></td><td>The server name sent to the client when it connects. The default is <code>Remote Desktop Manager Devo CLI MCP Server</code>.</td></tr></tbody></table>

For example, to give an agent read-only access to one workspace:

```json
{
  "mcpServers": {
    "devolutions": {
      "command": "devo",
      "args": ["mcp", "--context", "<context-name>", "--read-only", "--deny-tool", "RDM_resolve_secret_reference"]
    }
  }
}
```

## What the model can do

All tool names start with `RDM_`. They cover these areas:

<table><thead><tr><th width="200">AREA</th><th>EXAMPLES</th></tr></thead><tbody><tr><td><strong>Workspaces</strong></td><td>List the workspaces the session can use (local profile and each saved Devolutions Cloud or Devolutions Server context) and switch between them for the rest of the session.</td></tr><tr><td><strong>Vaults and entries</strong></td><td>List vaults, search entries, get an entry, list its metadata, attachments, permissions, and logs; create, update, or delete vaults; update, move, or delete entries; export activity logs to a local file.</td></tr><tr><td><strong>Users and access</strong></td><td>List users and groups, create or delete groups, delete users, list vault access, grant or revoke a vault role, list security roles and permission sets.</td></tr><tr><td><strong>Passwords</strong></td><td>Generate strong, human-readable, passphrase, or pattern passwords locally.</td></tr><tr><td><strong>Secrets</strong></td><td>Resolve a <code>devo://</code> reference to its value (<code>RDM_resolve_secret_reference</code>). The answer contains the secret.</td></tr><tr><td><strong>Background process</strong></td><td>Check, start, reload, restart, or stop the Devolutions CLI background process.</td></tr></tbody></table>

Tools that create, change, or delete vaults, entries, groups, users, or access require an explicit confirmation in the request. The model gives that confirmation, not you: to keep the model away from changes, use `--read-only`.

The MCP server can't start programs with secrets: to have an agent run a tool with a credential, use `devo secret run`. See [Give an agent a credential without exposing it](/cli/guides/ai-agents/run-an-agent.md).

## See the tool list

To see which tools the server exposes, without starting it:

```bash
devo mcp catalog --json
```

In the JSON result, the tools the server would expose have `"visible": true`. The text output shows the first 25 only. `devo mcp catalog` accepts the same restriction options as `devo mcp`, so you can preview a configuration before you give it to your client. One exception: the preview always marks `RDM_resolve_secret_reference` as hidden, even when `devo mcp` would expose it. See [Limit what an agent can do](/cli/guides/ai-agents/limit-tools.md#preview-your-configuration).

## Good to know

* **The background process starts on its own.** When the server needs your workspace, `devo mcp` starts the Devolutions CLI background process before it answers the client, unless you start the server with `--daemon require`, `--daemon never`, or `--no-daemon-autostart`. If tools report that the process is unavailable, see [The background process won't start](/cli/help/troubleshooting/daemon-wont-start.md).
* **The session's workspace can change.** Unless you start the server with `--read-only`, the model can switch the workspace for the rest of the session, among the local profile and the contexts you saved. The tools that switch it aren't read-only, so `--read-only` hides them.
* **The server runs as you.** Any program that can start `devo mcp` under your user account gets the same access to your vaults.

## Next

* [Limit what an agent can do](/cli/guides/ai-agents/limit-tools.md)
* [Give an agent a credential without exposing it](/cli/guides/ai-agents/run-an-agent.md)
* [What stays hidden, and what doesn't](/cli/guides/understand/security-model.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/cli/guides/ai-agents/connect-mcp.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.