# Agent-connect recipe — document Claude Code/Cursor → bex `/mcp` with OAuth 2.1

w4/m9 shipped the OAuth 2.1 provider for agents (Hydra bridge, headless consent, RFC 9728 resource metadata — docs/ADR012-auth.md §7; `BEX_OAUTH_ISSUER`/`BEX_OAUTH_RESOURCE` in bex-api), so a real MCP client can authenticate to `/mcp` — but nothing documents the connect flow end-to-end. Write the recipe: Claude Code (`claude mcp add`) and Cursor config snippets, what the discovery/401→token dance looks like, the API-key alternative for headless use, and a troubleshooting line for the 503/discovery-unset case. One docs page (e.g. `docs/ADR025-connect-an-agent.md`) + docs-index rows in CLAUDE.md/README; prettier. Sub-hour.

Why now: the AI-native surface (pillar 3) is shipped but undiscoverable without a written connect path.

Source: second `/pm-brainstorm for w2` 2026-07-08; w4/m9 (done 2026-07-08).

**2026-07-11: done.** Shipped [docs/ADR025-connect-an-agent.md](../../docs/ADR025-connect-an-agent.md) — discovery/DCR/PKCE flow, `claude mcp add`/`claude mcp login` and Cursor `mcp.json` snippets, the API-key bearer-token alternative, stdio for local dev, and troubleshooting (discovery-unset, 503, denied consent for a self-registered client, token TTL). Docs-index rows added to `CLAUDE.md` and `README.md`.
