# Capital Workbench — agent connections

- Connection guide: https://capital-workbench.com/agents
- MCP endpoint: https://mcp.capital-workbench.com/mcp
- Authorization metadata: https://capital-workbench.com/.well-known/oauth-authorization-server
- Protected resource metadata: https://mcp.capital-workbench.com/.well-known/oauth-protected-resource/mcp
- Automatic authorization: Available

Use an MCP client that supports OAuth authorization code with PKCE S256.
Discover the authorization server from the MCP endpoint's 401 challenge.
Register using a Client ID Metadata Document or the advertised registration endpoint.
Use resource=https://mcp.capital-workbench.com/mcp in authorization and token requests.
Request mcp:read and offline_access to renew access automatically.
Open the authorization URL in the user's browser for CW sign-in and approval.
Store credentials in the client's protected credential storage. Do not request the
CW password in chat, bypass consent, or include tokens in URLs or conversations.
Refresh serially and replace the old refresh token after every successful renewal.
Users manage connections at https://capital-workbench.com/account/mcp.
Manual bearer tokens remain available there for clients without OAuth support.
Access uses the account's existing Stripe tier, persistent limits and publication safeguards.