One connection layer for every agent.
Working Machines is a hosted application layer for Codex, Claude, ChatGPT, Cursor, custom agents, and application code. It provides access to 1,400+ apps and 15,000+ structured actions without placing provider credentials inside the agent process.
01 / QUICKSTART
Connect your first agent
Create your workspace, connect the apps your agent needs, then add the hosted MCP endpoint to your agent configuration.
Working Machines Cloud
Create an account, connect providers in the dashboard, and point your agent at one OAuth-enabled MCP URL.
OPEN PLATFORM02 / MCP
Connect your agent
OAuth-aware MCP clients need only the server URL. The authorization popup signs the user into Working Machines, asks for consent, and returns a token scoped to that account.
{
"mcpServers": {
"working-machines": {
"url": "https://app.workingmachines.dev/mcp"
}
}
}Codex
Add the config, then run codex mcp login working-machines.
Claude
Add a custom connector using the hosted MCP URL.
Custom agents
Use Streamable HTTP with OAuth 2.1 or a bearer API key.
http://localhost:3000/mcp. The hosted endpoint is https://app.workingmachines.dev/mcp.03 / CONNECTIONS
Connect accounts once
Provider credentials remain in the runtime boundary. Agents receive connection labels, granted scopes, schemas, and execution results—not raw API keys or OAuth tokens.
API keys
Store default or named connections and validate them against provider identity APIs.
OAuth 2.0
Use deployment-owned OAuth apps with explicit callback URLs and optional scope subsets.
Custom credentials
Validate only the fields declared by each provider contract; unknown fields are rejected.
04 / ACTIONS
Discover first. Execute second.
The MCP surface stays small even as the catalog grows. Agents search the catalog, inspect an Action guide, select a connection, and execute the exact Action contract.
list_appslist_connectionssearch_actionsget_action_guideexecute_action05 / DEVELOPERS
MCP, HTTP API, and OpenAPI
Use the same provider IDs, Action IDs, schemas, connection aliases, and policy boundary from an agent host or application code.
Runtime API
/v1/actions, /openapi.json, and per-Action markdown guides.
TypeScript
Call the HTTP API directly with fetch, or generate a typed client from the OpenAPI document.
curl -X POST https://app.workingmachines.dev/v1/actions/github.get_current_user \
-H "Authorization: Bearer <RUNTIME_TOKEN>" \
-H "Content-Type: application/json" \
-d '{"input":{}}'const response = await fetch(
"https://app.workingmachines.dev/v1/actions/github.get_current_user",
{
method: "POST",
headers: {
Authorization: `Bearer ${process.env.WORKING_MACHINES_TOKEN}`,
"Content-Type": "application/json",
},
body: JSON.stringify({ input: {} }),
},
);
const result = await response.json();06 / SECURITY
A boundary the model cannot cross
Working Machines protects credentials and constrains execution, but tool results are returned to the calling agent. Sensitive output handling therefore still depends on your model provider, prompts, retention settings, and chosen Actions.
Credentials
Credential records are protected at rest. Raw provider secrets are never exposed through discovery or run results.
Authorization
OAuth 2.1 for MCP clients, hashed API keys, persistent runtime tokens, optional JWT validation, and separate administrator access.
Least privilege
Allow/block Action policy, provider proxy grants, connection-level grants, and provider-native OAuth scopes.
Network safety
Shared SSRF guards validate URLs, redirects, and resolved addresses. Private-network access is explicit and deployment-gated.
Auditability
Redacted run logs record Action identity, connection identity, result status, timing, and policy decisions.
Data path
Tool inputs and results pass through the runtime and return to the calling agent. They are not automatically anonymized.
07 / REFERENCE
Platform reference
These stable surfaces are available from every Working Machines workspace. Authenticate HTTP requests with a runtime token or use OAuth through MCP.
Working Machines is a hosted platform. Use the MCP endpoint for compatible agents or the documented HTTP and OpenAPI surfaces for application code.