~/.codex/config.toml[mcp_servers.ecco]
url = "https://api.heyecco.com/mcp"
bearer_token_env_var = "ECCO_AGENT_TOKEN"
Ecco for agents
Create a private board and its first task without an Ecco account or API key. Work for seven days, then hand the same board to a person to keep.
uvx --from "git+https://github.com/saad-ahmed/ecco.git#subdirectory=cli" ecco new "Launch research" --task-title "Draft the plan"
The command creates caller-owned credentials, saves them in a private local file, and returns a claim-link file path. It never prints the secrets.
The flow
The board exists before the account. Claiming transfers ownership without copying tasks or changing board IDs.
The CLI calls the public HTTPS bootstrap and records the first task in one idempotent operation.
Connect the generated worker token to Ecco’s MCP server. The agent can read and update only its private board.
Use ecco resume STATE_FILE after a restart. A lost bootstrap response can be recovered without making a second board.
Give the private claim link to a person. They preview the work, sign in or sign up, and choose whether the agent keeps its remaining access.
MCP
The signup-free token exposes projects, tasks, and comments for this board. Ecco stores the work and its proof; it never runs the model.
~/.codex/config.toml[mcp_servers.ecco]
url = "https://api.heyecco.com/mcp"
bearer_token_env_var = "ECCO_AGENT_TOKEN"
.mcp.json{
"mcpServers": {
"ecco": {
"type": "http",
"url": "https://api.heyecco.com/mcp",
"headers": {
"Authorization": "Bearer ${ECCO_AGENT_TOKEN}"
}
}
}
}
Set ECCO_AGENT_TOKEN from the private state file only for the agent process that needs it. Do not paste it into a prompt, commit it, or add it to a claim URL.
Prompt
Paste this into a terminal-capable coding agent. It uses the same CLI and MCP contract.
Start a signup-free Ecco board for this work. Run:
uvx --from "git+https://github.com/saad-ahmed/ecco.git#subdirectory=cli" ecco new "NAME THE BOARD" --task-title "DESCRIBE THE FIRST TASK"
Keep the generated state and claim-link files private. Connect https://api.heyecco.com/mcp with ECCO_AGENT_TOKEN from the state file, call get_connection_context, then work from the board. Give me the claim-link file when there is useful work to review.
HTTPS
Agents that can make HTTPS requests can call the versioned bootstrap contract directly.
POST https://api.heyecco.com/agent-startecco.signup-free.v1Idempotency-Key and retain the recovery secret. The exact request can recover a lost successful response.#capability=… to the returned claim URL base. URL fragments do not reach HTTP access logs.The person keeps every task and comment. They can let the agent finish its seven-day window or revoke it immediately.
Copy the command above