Put an agent on your backlog.
Agent access gives an AI agent — Claude, or anything else that speaks MCP — a scoped, revocable way to work inside your projects. It reads the backlog you prioritized, works the top item, and reports back in comments. Nothing to install: one command and a key.
In Beta · One agent per account · Agents don't use a billable seat
A teammate that happens to be a machine.
An agent is a member of your account with its own name, its own access, and its own key — not a copy of yours.
Its own identity
Everything the agent does is attributed to it by name — on the board, in the task activity feed, and in the audit log. You can assign it a task like anyone else, and you can always tell its work from yours.
Only what you grant
Access comes from Teams, exactly like a teammate's: add the agent to a team, put that team on a project. A brand-new agent belongs to no team and sees nothing at all — it fails closed.
A key you control
Issue it, choose how long it lasts, revoke it in one click — effective on the agent's very next request. Up to five keys can be live at once, so each place the agent runs can hold its own.
A short list of verbs
Lists, tasks, subtasks, and comments — create, read, update, complete, reopen. That's the whole surface. No deleting, no billing, no people or settings, and nothing in Time Tracker or CRM.
Three steps.
- Create the agent. Go to Settings → Agents in Project Management (you'll need to be a company admin) and create one — name it after the agent that will use it, e.g. "Claude". You get a key immediately, shown once. Copy it then; it can't be retrieved later, only replaced.
- Grant it work. On Teams, add the agent to a team, and make sure that team is on the projects it should work in. Until you do, the agent authenticates fine and sees zero projects. Most people point it at one dedicated backlog project to start.
-
Connect a client. Point any MCP-capable client at your workspace's
agent endpoint and send the key as an
Authorization: Bearerheader.
https://project.sbassistant.com/api/agent/mcpThe commands for each client are below, and the same list is on the agent's card under Connect your agent in Settings → Agents.
Connecting each one.
The endpoint is a standard remote MCP server authenticated by a header, so anything that speaks MCP over HTTP can use it. These are the ones we've verified.
Claude Code — one registration covers the CLI, the desktop and web apps, and the VS Code and JetBrains extensions.
claude mcp add --transport http sbpm-agent https://project.sbassistant.com/api/agent/mcp --header "Authorization: Bearer sbpm_ak_your_key_here"
Keeping the key out of your config: --header writes the key
into ~/.claude.json in plain text. To avoid that, register a
headersHelper instead — a command Claude Code runs at connect time whose
output is merged into the request headers. Point it at a two-line script that reads the key
from your OS keychain or credential manager and no config file ever holds the secret.
VS Code / GitHub Copilot agent mode — in .vscode/mcp.json:
{
"inputs": [
{ "id": "pm_agent_key", "type": "promptString", "password": true }
],
"servers": {
"sbpm-agent": {
"type": "http",
"url": "https://project.sbassistant.com/api/agent/mcp",
"headers": { "Authorization": "Bearer ${input:pm_agent_key}" }
}
}
}
Two things to know. It has to be .vscode/mcp.json — headers in a workspace
.mcp.json are silently discarded, and the server then fails to authenticate
with no obvious reason why. And ${input:…} prompts you for the key and stores
it securely rather than leaving it in a file you might commit.
GitHub Copilot coding agent and code review — add the server to the repository's MCP configuration and supply the header value from a repository or organization secret.
A header is the only option there: Copilot's cloud agent and code review don't support OAuth for remote MCP servers. Copilot CLI connects the same way.
claude.ai custom connectors — request-header authentication is still rolling out in beta at Anthropic, so we can't promise a custom connector will work on your account yet. Everything above is generally available today.
Swapping a key without downtime.
- Issue a new key on the agent's card. The old one keeps working the whole time.
- Update the
Authorizationheader wherever that client stores it, and reconnect. - Watch the new key's Last used advance on the agent card — that's your proof the swap took.
- Only then, revoke the old key.
Up to five keys can be active at once. Give each place the agent runs its own — laptop, CI, a second workspace — and revoking a leaked one costs a single reconnection instead of knocking every client offline.
You pick a key's lifetime when you issue it: one month, six months, one year, or never. An expiring key retires itself and frees its slot with nobody revoking anything, and the agent's card warns you 30 days ahead so nothing stops working by surprise.
When it doesn't connect.
| What you see | What it means | What to do |
|---|---|---|
| 401 Unauthorized | The key was revoked, has expired, or the agent itself was deactivated. The response deliberately doesn't say which. | Check the key's status on the agent's card in Settings → Agents. Issue a fresh key, or reactivate the agent. |
| It connects, but everything is "not found" | Either the agent has no team grant for that project, or agent access isn't switched on for your account. A project you haven't been granted is indistinguishable from one that doesn't exist — that's on purpose. | Add the agent to a team on Teams and put that team on the project. If even the endpoint itself returns 404, agent access isn't enabled for your account — email support@sbassistant.com. |
| 429 Too Many Requests | Rate limit. Each key has a per-minute burst allowance and a daily ceiling. | Slow the loop down and retry. Sustained 429s usually mean something is polling in a tight loop rather than working tasks. |
Still stuck? Email support@sbassistant.com — include the key's 12-character prefix from the agent card, never the key itself.