> For the complete documentation index, see [llms.txt](https://docs.datasentinel.io/manual/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.datasentinel.io/manual/ai-connector/connect-a-cli-assistant/connect-a-compatible-assistant.md). # Connect a compatible assistant The general pattern for connecting any MCP-and-Skill-capable assistant to Datasentinel, sign-in included, with Deep Agents Code and Hermes Agent as worked examples. The other pages in this section configure specific assistants (Claude Code, OpenAI Codex, Google Antigravity CLI, and so on). This page is the general pattern: any assistant that can speak MCP and accept instructions can use Datasentinel, even if it does not have a page of its own. It then shows two worked examples: LangChain's **Deep Agents Code** and Nous Research's **Hermes Agent**. ## What makes an assistant compatible An assistant can use Datasentinel when it meets three requirements: 1. **It has an MCP client** that can connect to a remote server over streamable-HTTP (HTTPS). 2. **Its MCP client can sign in with OAuth 2.1**, registering itself with the server (dynamic client registration) and opening the Datasentinel login page in a browser. Every major MCP client does; a client without OAuth can still connect with a static authorization header carrying a user token, which suits scripts. 3. **It accepts instructions** that you can use to load the Datasentinel Skill, either as a system prompt or through a native Skills loader. When all three hold, the steps are always the same. Point the MCP client at `https:///mcp` (see [MCP Server Setup](/manual/ai-connector/server-setup/mcp-server-setup.md)), sign in once with your platform login and password when the client asks, then give the assistant the Datasentinel Skill's instructions. Nothing else goes in the configuration: no token, no header. The details of the sign-in, including the no-browser and script cases, are in [How authentication works](/manual/ai-connector/server-setup/how-authentication-works.md). {% hint style="warning" %} **Name MCP servers with a `datasentinel-` prefix.** Every Datasentinel MCP server you register must be named starting with `datasentinel-`, for example `datasentinel-production` or `datasentinel-staging`. The Skill discovers Datasentinel servers by this prefix, so a server named otherwise will not be picked up. {% endhint %} ## The Datasentinel Skill The Skill ships as `datasentinel-skill.zip`, whose entrypoint is `SKILL.md`; unzipping the archive produces a single `datasentinel/` folder. Download it from . Turnkey assistants discover a Skills folder automatically (see the other pages in this section). For an assistant you build yourself, you have two options: * Load the Skill folder with the framework's **native Skills loader**, if it has one. Both examples below do. * Otherwise, read `SKILL.md` and pass its contents as the agent's **system prompt**. This universal path works for any assistant that accepts a system prompt. {% hint style="info" %} If your platform serves the `/mcp` endpoint with a self-signed certificate, configure your MCP client's TLS trust rather than disabling verification. For the Python examples below, point the standard `SSL_CERT_FILE` environment variable at a PEM bundle containing your internal CA. The browser that opens the login page must trust the certificate too. A valid certificate is **highly recommended**. {% endhint %} ### How the Skill loads With a native Skills loader, the Skill loads on demand: the assistant reads its name and `description` up front, and pulls in the full instructions automatically when the request relates to Datasentinel (PostgreSQL performance, instances, sessions, the platform itself). One Skill serves every platform, because it discovers all the `datasentinel-*` MCP servers you registered, so adding a second platform needs no Skill change. If the assistant answers generically instead (no Datasentinel tool calls in the response), load the Skill manually: ask it explicitly, for example `Use the datasentinel skill to check the platform status`, or use the framework's own invocation mechanism (many expose each Skill as a `/datasentinel` slash command). With the system-prompt path there is nothing to trigger, since the instructions are always in context. ## Example: Deep Agents Code [Deep Agents Code](https://docs.langchain.com/oss/deepagents/code/overview) (`dcode`, formerly published as the deepagents CLI) is LangChain's terminal coding agent built on the Deep Agents SDK. It connects to Datasentinel without writing any code. The steps mirror the [Claude Code page](/manual/ai-connector/connect-a-cli-assistant/configure-claude-code.md): add the server, sign in once, install the Skill, check. ### Install Deep Agents Code Install it with the official installer, then run `/auth` once to add your model provider's credentials: ```bash curl -LsSf https://langch.in/dcode | bash dcode ``` ### Add the Datasentinel MCP server Add your Datasentinel MCP server to `~/.deepagents/.mcp.json`, which applies to all your projects (a project can carry its own in `.deepagents/.mcp.json`). Use `"type": "http"` for a remote streamable-HTTP endpoint and `"auth": "oauth"` so the client signs in: ```json { "mcpServers": { "datasentinel-production": { "type": "http", "url": "https:///mcp", "auth": "oauth" } } } ``` Set `type` to `sse` only for a Server-Sent-Events endpoint; Datasentinel uses streamable HTTP. Deep Agents Code trusts nothing it finds in a project file until you approve it, and the login command refuses an unapproved server (`Skipping untrusted project MCP server entries`). So start `dcode` once in the directory you work from; it lists the new server and asks: ``` Approve project MCP servers: "datasentinel-production" (http): https:///mcp Allow once Allow for this project — until changed ``` Choose **Allow for this project** and quit. ### Sign in to the platform #### With a browser Sign in once from the terminal: ```bash dcode mcp login datasentinel-production ``` Deep Agents Code prints the authorization link and opens the Datasentinel login page in your browser. Sign in with your **platform login and password**, the same ones as the Datasentinel web interface. The page names the assistant that is asking; after the sign-in the browser hands the session back to Deep Agents Code, which confirms with `Logged in to MCP server 'datasentinel-production'`. You sign in once. The session is stored under `~/.deepagents/.state/mcp-tokens/` and renewed automatically. It asks again only after ten days without using the server, or when an administrator ends the session. Your password goes to the login page only; the agent never sees it and never asks for a token. Inside a session, `/mcp` shows each server's status. #### Without a browser On a server without a browser (an SSH session, a build machine), the same command works with no tunnel, because the login accepts the redirect address pasted back: ``` Open this URL in a browser, approve access, then paste the full callback URL back here: https:///authorize?response_type=code&client_id=... No browser is available to complete the OAuth flow. Paste the full callback URL instead. Callback URL: ``` Open the link on your laptop and sign in. The browser then lands on a `http://localhost:...` address it cannot reach; copy that address from the address bar and paste it at the `Callback URL:` prompt. The command confirms with `Logged in to MCP server 'datasentinel-production'`. Verified with the current release. The general procedure is in [How authentication works](/manual/ai-connector/server-setup/how-authentication-works.md#sign-in-from-a-server-without-a-browser). #### For a script or a scheduled run Where nobody can sign in, register the server with a user token as an authorization header instead of `"auth": "oauth"`. The token is the platform's 24-hour [user token](https://app.gitbook.com/o/DaDQkGCM7r2TghFSBFLQ/s/yE16Xb3IemPxJWydtPOj/implementation/platform-usage/api-reference/access-token). Header values accept `${VAR}` references, so the token stays out of the file: ```json { "mcpServers": { "datasentinel-production": { "type": "http", "url": "https:///mcp", "headers": { "Authorization": "Bearer ${DS_TOKEN}" } } } } ``` A server registered this way never opens the login page; when the token expires, the calls fail until a fresh one is set. See [Refresh the user token automatically](/manual/ai-connector/developers/refresh-user-token.md) to keep it current. ### Install the Datasentinel Skill Install the Skill in one of the directories Deep Agents Code scans at startup, `~/.agents/skills/` for personal use or `.agents/skills/` in a project, and check it is listed: ```bash mkdir -p ~/.agents/skills/ unzip datasentinel-skill.zip -d ~/.agents/skills/ dcode skills list ``` ### Check your configuration Start `dcode` and run `/mcp`: the server should show as connected. Then ask it about your platform. The Skill is also available as the `/skill:datasentinel` command, for example `/skill:datasentinel status`. Deep Agents Code asks before gated actions such as file writes and shell commands (Manual mode). If a Datasentinel tool call is held for approval, press `Shift+Tab` to switch to Auto mode, or start with `dcode -y`. See its [approval modes](https://docs.langchain.com/oss/deepagents/code/approval-modes). ## Example: Hermes Agent [Hermes Agent](https://github.com/NousResearch/hermes-agent) is Nous Research's open-source agent framework, driven by the Hermes function-calling models. It has first-class MCP support, OAuth included, and connects to both local and remote servers. ### Install Hermes Agent The installer brings its own Python and Node.js, but it needs `git`, `curl`, `xz` and a C++ compiler on the host, the compiler to build native modules; without the compiler it stops with `Install a C++ compiler (g++/gcc-c++) via your package manager`. Install them first, then run the installer, the one-time setup, and launch it: {% tabs %} {% tab title="RHEL, Rocky, Alma" %} ```bash sudo dnf install -y git gcc-c++ curl xz ``` {% endtab %} {% tab title="Debian, Ubuntu" %} ```bash sudo apt install -y git build-essential curl xz-utils ``` {% endtab %} {% endtabs %} ```bash curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash hermes setup --portal hermes ``` ### Add the Datasentinel MCP server Add your Datasentinel MCP server to `~/.hermes/config.yaml` with `auth: oauth`, so Hermes handles the discovery, registration, PKCE and token refresh itself: ```yaml mcp_servers: datasentinel-production: url: "https:///mcp" auth: oauth ``` ### Sign in to the platform #### With a browser Sign in once from the terminal: ```bash hermes mcp login datasentinel-production ``` Hermes prints the authorization link, opens the Datasentinel login page in your browser, and waits for the browser to come back on a local port. Sign in with your **platform login and password**, the same ones as the Datasentinel web interface. The page names the assistant that is asking; after the sign-in the browser hands the session back to Hermes. You sign in once. The session is stored in `~/.hermes/mcp-tokens/` and reused until it expires; Hermes renews it by itself and asks again only after ten days without using the server, or when an administrator ends the session. Your password goes to the login page only; the agent never sees it and never asks for a token. #### Without a browser On a server without a browser (an SSH session, a build machine), the same command works with no tunnel. Hermes detects the headless environment and accepts the redirect address pasted back: ``` MCP OAuth: authorization required. Open this URL in your browser: https:///authorize?response_type=code&client_id=... (Headless environment detected — open the URL manually.) Or paste the redirect URL here (or the ``?code=...&state=...`` portion) and press Enter. Type ``skip`` + Enter to continue without this server: ``` Open the link on your laptop and sign in. The browser then lands on a `http://127.0.0.1:...` address it cannot reach; copy that address from the address bar, or just its `?code=...&state=...` part, paste it at the prompt and press Enter. Verified with the current release. Hermes' device-code alternative (`--flow device`) does not apply, as the Datasentinel server offers no device endpoint. The general procedure is in [How authentication works](/manual/ai-connector/server-setup/how-authentication-works.md#sign-in-from-a-server-without-a-browser). #### For a script or a scheduled run Where nobody can sign in, register the server with a user token as an authorization header instead of `auth: oauth`. The token is the platform's 24-hour [user token](https://app.gitbook.com/o/DaDQkGCM7r2TghFSBFLQ/s/yE16Xb3IemPxJWydtPOj/implementation/platform-usage/api-reference/access-token). Hermes resolves `${VAR}` references from `~/.hermes/.env` when it connects, so the token stays out of the configuration file: ```yaml mcp_servers: datasentinel-production: url: "https:///mcp" headers: Authorization: "Bearer ${DS_TOKEN}" ``` A server registered this way never opens the login page; when the token expires, the calls fail until a fresh one is set. See [Refresh the user token automatically](/manual/ai-connector/developers/refresh-user-token.md) to keep it current. ### Install the Datasentinel Skill Skills live in `~/.hermes/skills/`, each a folder containing a `SKILL.md` (see the [Hermes Agent Skills documentation](https://hermes-agent.nousresearch.com/docs/user-guide/features/skills)). Unzip the archive there so the agent discovers it automatically: ```bash mkdir -p ~/.hermes/skills/ unzip datasentinel-skill.zip -d ~/.hermes/skills/ ``` Run `hermes skills list` to confirm `datasentinel` is installed. Once it is, the Skill is available as a `/datasentinel` slash command and through natural conversation. {% hint style="info" %} Hermes Agent's configuration keys evolve between releases, so confirm the exact MCP field names against the [Hermes Agent MCP documentation](https://hermes-agent.nousresearch.com/docs/user-guide/features/mcp) before you rely on the YAML snippets. {% endhint %} ## Verify However you connect, the check is the same. Ask the assistant, in plain language, to run the Datasentinel Skill's built-in checks: | Ask the assistant for… | What it does | | ------------------------ | ---------------------------------------------------------------------- | | `datasentinel help` | Confirms the Skill's instructions are loaded. | | `datasentinel platforms` | Lists every `datasentinel-*` MCP server the Skill discovered. | | `datasentinel status` | Checks the platform status, confirming the MCP server answers. | | `datasentinel whoami` | Shows who you are signed in as, your privilege and the session expiry. | These four are the setup checks. The full command list, with what each one needs, is in the [Skill commands reference](/manual/ai-connector/use-the-assistant/skill-commands.md). {% hint style="success" %} If the assistant reports a healthy platform for `datasentinel status`, the MCP server and the Skill are wired together correctly. You can now ask it questions about your instances in plain language. {% endhint %} {% hint style="info" %} **Server not discovered? Ask the assistant to find the root cause.** If `datasentinel platforms` lists nothing, or your server is missing from it, ask the assistant to debug the setup rather than hunting by hand. Any assistant that can read files and run commands on the host can inspect its own MCP configuration (`~/.deepagents/.mcp.json`, `~/.hermes/config.yaml`, or whatever your framework uses), list the tools it actually loaded, and probe the endpoint itself. Ask it something like: ``` The datasentinel-production MCP server is not discovered. Investigate and find the root cause: check my MCP configuration, the tools you actually loaded at startup, and whether the /mcp endpoint answers. ``` Typical causes it surfaces: a server name that misses the `datasentinel-` prefix, a typo in the URL, the wrong transport type (`sse` instead of `http`), a configuration file the agent does not read, a server you have not signed in to, an untrusted TLS certificate, or a platform that is down. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.datasentinel.io/manual/ai-connector/connect-a-cli-assistant/connect-a-compatible-assistant.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.