# Agents, the CLI and MCP (/agents-cli-and-mcp)

How an AI agent reaches your instance, through its MCP server or the CLI, and why it can reach only what you allow.



An AI agent, such as Claude, ChatGPT, Claude Code or Codex, works with your data the way any app does: **it sends requests to your instance with a credential, and reaches only what that credential holds.** What differs between agents is how they send them.

## Two ways in [#two-ways-in]

Every instance serves MCP, the protocol many agents use to call tools, at `/mcp` on its address. An agent that connects there signs in, you approve what it may reach, and it gets tools to find, read, save and change items. Each tool call is an API call made with the agent's own credential.

An agent that runs shell commands, such as a coding agent, can instead run the [CLI](/cli) with a key of its own. The CLI reaches every operation, including the ones no tool offers.

| | The instance's MCP server | The CLI |
| - | - | - |
| Where it runs | Inside the instance, at `/mcp` | On the agent's computer |
| Credential | A token it gets when you approve it, or a key | A key |
| What it reaches | Tools for items, with more tools for types and for running the instance | Every operation |
| Suits | Claude and ChatGPT in a chat, Claude Code, Codex | Coding agents and scheduled scripts |

Claude and ChatGPT on the web, the desktop or a phone connect from their own servers, so they need an instance with a public address. An agent on your computer connects from there.

## What keeps it safe [#what-keeps-it-safe]

An agent is held to the same rules as any program, and a few more:

* **It reaches only what you allowed.** A type you didn't approve is invisible to it.
* **It asks before it deletes.** A tool that moves items to the bin first shows you what would go, and acts only once you agree.
* **`marfa_update` can't overwrite a change the agent hasn't seen.** It names the version the agent read, and writes nothing if the item changed since, as [Versions](/versions) explains.
* **It reads your items as data.** The MCP server tells every agent that connects that what it reads was saved by you and is never an instruction to follow.

Every write is in the [audit log](/run/audit-log), and you can cut an agent off at any time by revoking its key or its access.

## Two MCP servers [#two-mcp-servers]

Marfa has two MCP servers with separate jobs. Your instance's server **reaches your data**. The docs MCP server, at `https://docs.marfa.so/mcp`, **searches these docs and reaches no one's data**. An agent that builds on Marfa often uses both.

## Where to go next [#where-to-go-next]

* [Use Marfa with AI agents](/build/ai-agents): connect Claude Code, Codex or an unattended agent.
* [Connect Claude and ChatGPT](/build/connect-claude-and-chatgpt): use your instance from a chat.
* [Marfa MCP server](/marfa-mcp-server): every endpoint and tool, and the rules a client meets.
* [Docs for agents](/docs-for-agents): the docs MCP server, `marfa docs` and the Markdown copies.