# Springroll for agents

> Connect Springroll to Codex, Claude Code or another MCP-compatible harness. Agent keys are scoped to one organization and control which tools the agent can read or change.

## Endpoints

- MCP: https://mcp.springroll.sh/mcp
- Agent REST API: https://api.springroll.sh/agent/v1
- OpenAPI: https://api.springroll.sh/openapi.json
- Dashboard: https://dashboard.springroll.sh/

## Authentication

Create an agent key in the Springroll dashboard. Send it as a bearer credential when connecting to MCP or REST. The raw key is shown once. Springroll stores a hash and the organization/scopes attached to the key.

## Harness setup

Codex can add the remote MCP URL with:

    codex mcp add springroll --url https://mcp.springroll.sh/mcp

Claude Code can add the remote MCP URL with:

    claude mcp add --transport http springroll https://mcp.springroll.sh/mcp

Configure the Springroll agent key using the client’s secure bearer-token or Authorization mechanism.

## Permission model

Common scopes include `org:read`, `people:read`, `people:write`, `time:read`, `time:write`, `time:approve`, `expenses:read`, `expenses:write`, `expenses:approve`, `payroll:read`, `payroll:write`, `payroll:calculate`, `payroll:approve`, `billing:read`, `onboarding:read`, and `onboarding:write`.

Payroll approval is separate from payroll calculation. A run cannot be approved until validated tax data is present.