MCP · attention.run

attention.run gives AI agents a screen through the Model Context Protocol (MCP). An agent opens a session on a target, reads the screen as a list of named elements (text, not a screenshot each step), acts on them and waits for what it expects, with the same matching and waiting rules as flows. When it is done, it can save what it did as a flow that runs without a model.

Connecting a client

The hub serves MCP’s Streamable HTTP transport at /api/v1/mcp. On the hosted app that is:

https://app.attention.run/api/v1/mcp

A client signs in one of three ways: by itself over OAuth (the usual way, below), with an API token as Authorization: Bearer …, or with nothing on a local hub (http://127.0.0.1:7300/api/v1/mcp).

By address (OAuth)

Apps that add an MCP server by its address (Claude’s custom connectors, ChatGPT’s connectors, Claude Code, Cursor, MCP Inspector) sign in by themselves, with MCP’s standard authorization. Give the app the address above (Settings → Connected apps shows it with a copy button). The app opens a page of the hub where you sign in as usual and choose what its agent may do: which targets, and whether it may navigate anywhere, run flows or propose elements. Allow sends you back to the app, which then has its own tokens: no token to copy. Settings → Connected apps lists each app with who allowed it and when it was last used, and Revoke stops it at once.

In claude.ai or Claude Desktop, add it as a custom connector (Settings → Connectors) with that address. In Claude Code, add it, then run /mcp in Claude Code and pick attn to sign in:

claude mcp add --transport http attn https://app.attention.run/api/v1/mcp

An app’s tokens reach the MCP endpoint only, held to what you allowed. They last an hour and are refreshed by the app; an app unused for 30 days, or whose person is no longer a user of the hub, has to be connected again.

With an API token

For a client that can’t sign in by itself but speaks Streamable HTTP and takes a header (a script, CI), make an API token for agents (Settings → API tokens, “For: an AI agent”) and send it as a header. For Claude Code:

claude mcp add --transport http attn https://app.attention.run/api/v1/mcp --header "Authorization: Bearer attn_api_…"

Clients that start a local process instead (stdio) run attn mcp, a proxy that reads one JSON-RPC message per line, posts it to the hub’s endpoint with ATTN_TOKEN, and writes each answer as a line. In a client’s configuration, with the path of your checkout:

{
  "mcpServers": {
    "attn": {
      "command": "node",
      "args": ["/path/to/attention/apps/cli/src/main.ts", "mcp"],
      "env": { "ATTN_HUB": "https://app.attention.run", "ATTN_TOKEN": "attn_api_…" }
    }
  }
}

What attn mcp does, by hand: initialize, then call a tool.

export ATTN_HUB=https://app.attention.run
export ATTN_TOKEN=attn_api_…
printf '%s\n' \
  '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"docs","version":"1"}}}' \
  '{"jsonrpc":"2.0","method":"notifications/initialized"}' \
  '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"targets_list","arguments":{}}}' \
  | attn mcp

Tools

Tool	What it does
`targets_list`	The targets sessions can open on: id, name, connector, whether an SSH target is online
`session_open`	Opens a session on a target (by id or name), with a library, and returns the first observation once the screen is still
`session_close`	Ends a session
`observe`	What is on screen: the detected screen (a library screen says so), the library’s elements that are visible, with their positions and states, and the change since the last action that no known element explains, as compact text or JSON
`wait_for`	Waits for a condition (the flow JSON’s, a library screen too); a timeout is an answer, with what was missing and the best candidate, not an error
`act`	Clicks, double-clicks, right-clicks, hovers, drags, scrolls, types, presses a chord or navigates, then optionally waits for a condition
`events`	The session’s events since an earlier result’s cursor; rarely needed, since every result carries the events since the previous call
`watch`	Tells the agent when something happens while it does other things (an element appears or goes, the screen changes, a change no known element explains): a notification, and the event marked in its next result
`unwatch`	Ends a watcher, every watcher on a session, or all of them
`read_text`	The text in an area of the screen (an element, a rect from it, or screen pixels), read by OCR on the runner: a value as text, cheaper than a screenshot
`read_clipboard`	The text the target copied after the agent’s last action
`screenshot`	A PNG of the screen or a region (`unexplained`: the area no known element explains), for what the library doesn’t know yet; the frame is pinned for proposals
`library_search`	Elements of the library by words in their slug, name, description, tags or aliases, and its screens by words in their names or elements
`element_propose`	Candidate boxes around a point on a pinned frame, each checked for uniqueness; with a slug, adds one as a `proposed` element for a person to accept
`flows_list`	Flows with their params and outputs
`flow_run`	Runs a flow on a target, in a session of its own, and waits for its result and outputs
`trajectory_save`	Drafts the session’s actions into a flow, with the elements it needs, saved for review

Every tool that works on a session takes an optional session, defaulting to the last one this MCP session opened. Results carry a short text rendering for the model and structuredContent matching each tool’s output schema. Errors (an ambiguous element, a refusal, a bad argument) come back as tool results the model can read and recover from.

A watcher’s events reach the client two ways. A client that opens the event stream (GET on the same endpoint, with its MCP session) gets each one as a logging notification, resumed with Last-Event-ID after a dropped connection; attn mcp opens it and forwards the notifications. Every client also sees the fired events, marked with their watcher, in its next tool result.

Safety

Elements tagged confirm in the library (a Pay or Delete button) refuse act unless it passes confirm: true, so the client can ask its human first; points ({ x, y }) and keys aren’t gated. A token reaches MCP only with the mcp scope (Settings → API tokens, “For: an AI agent”), and its grant says which targets it may open and whether it may navigate, run flows or propose elements; each is off until granted. An app connected by address gets the same choices on its consent page. An agent session takes at most 20 actions a second and stops at the token’s action budget, if it has one. Agent sessions are recorded by default and carry an Agent badge in the app.

Not built yet

Screens named in the library in observations (the library keeps named screens, and flows wait for them with { screen }; an agent’s observation still names the screen from the elements’ slugs), agents’ proposals watched in their own session before a person accepts them, and attn agent, a reference agent.