Roll out to your fleet

Connect employee AI clients

The MCP endpoint that gives an AI client your approved tools, and the Gateway base URL that gives it your approved models

This is the page to send an employee. Tools and models are separate connections, and an employee can have one or both: an MCP endpoint for the tools their Group grants, and a Gateway base URL and key for the models it allows. Neither requires anything the employee has to request from you first.

On a fleet you manage, the desktop client mints the employee’s Gateway key and, once policy signing ships, writes both connections on the machine, so nothing here is needed. Use this page for the self-setup path, and for any client the desktop client does not reach. Choose a rollout path covers which is which.

Connect to tools

Most MCP-capable AI clients accept a URL. Employees paste this one:

https://ah-api.merge.dev/mcp

On first connection the client opens a browser for SSO. After the employee authenticates, they see a consent screen listing the tools their Group has been granted, and the client receives a scoped token. It renews that token on its own from then on.

Claude takes a one-time admin setup, then employees connect themselves.

Admin setup. An Owner or Primary Owner (Team or Enterprise plan) adds Workforce as an organization custom connector, once:

  1. In Claude, go to Organization settings → Connectors
  2. Click Add, hover over Custom, then select Web
  3. Paste the remote MCP server URL https://ah-api.merge.dev/mcp, then click Add

Employee setup. Share these steps with employees on Claude desktop or cowork:

  1. Go to claude.ai/customize/connectors
  2. Find the connector and click Connect
  3. Sign in through SSO and complete your identity provider’s steps
  4. Confirm the selected tools, and the connector is ready to use

Ask the assistant for a tool the employee’s Group does not grant and the call fails. The ask lands in Requests for an admin to approve or decline.

Connect to models

Every AI client asks for the same three values. Point it at Gateway instead of the model provider and the provider key is replaced by a Gateway key.

InputValue
Base URLhttps://api-gateway.merge.dev/v1/openai for OpenAI-compatible clients, https://api-gateway.merge.dev/v1/anthropic for Claude Code and Claude Desktop
API keyThe employee’s own Gateway key, minted by the desktop client or the Workforce CLI, or a project API key the team already has
Model nameprovider/model, or default_routing to let the routing policy pick

Sending an Anthropic client to the OpenAI prefix is the most common setup mistake. default_routing is the value to prefer, because it leaves model choice with your routing policy rather than pinning one model in a config file the employee owns.

Each client asks for those three values in a different place, from a settings pane to ~/.codex/config.toml. The per-client setup guides have the exact configuration for each of the nine supported clients, at about five minutes apiece.

Next

Confirm traffic is arriving and coverage is real with the verification steps in Choose a rollout path.