Document the antigravity MCP config as stdio via mcp-remote

[robertjamesprior]

Summary

The antigravity page documents a serverUrl remote-server entry. That config does not work: Antigravity's remote-server client can complete the OAuth flow and still send initialize without the bearer token, which comes back as 401 Unauthorized (antigravity-cli#25). The page already carried that as a warning and pointed readers at an API key; the primary path it documents fails on first contact.

Switches the documented config to the npx mcp-remote stdio entry, matching the Claude Desktop, Windsurf and Zed pages. mcp-remote runs the OAuth flow itself, so the token never depends on Antigravity's client.

What changed on the page:

• Config. serverUrl → command / args, plus a line telling anyone who already installed the old shape to drop the serverUrl key.
• Warning → Note. The failure is no longer something the reader hits, so it becomes the reason the config is stdio rather than a remote server.
• Connect. Reload from Settings → Customizations → Installed MCP Servers, then authorize in the browser mcp-remote opens. The old paste-the-code-back step belongs to Antigravity's native OAuth, which this config no longer uses. Token cache location updated to ~/.mcp-auth.
• API key. Reframed from "workaround for broken OAuth" to the headless/scripted path, and rewritten to pass the key through --header-file, which keeps it out of the process list.

Merge order

This can land ahead of kernel/cli#265, and probably should.

#612 has already merged, so the published page documents a config that fails today. The manual-config path this PR corrects needs no CLI at all, so merging this stops that immediately. The one line that does depend on #265 — kernel mcp install --target antigravity, which no released CLI has; latest is v0.39.3 and main has no such target — is already published and already wrong, and nothing here makes it more so.

On --header-file rather than --header plus env

The first push of this branch used mcp-remote's documented "Authorization:${VAR}" form with the value in env. That was wrong. mcp-remote stores a --header value literally — parseHeaderLine regex-matches Name: value and does no process.env expansion — so the substitution has to come from the client, and Antigravity documents env for stdio servers without documenting substitution inside args. The header would have gone out as the literal placeholder.

--header-file is read by mcp-remote itself, so it does not depend on the client, and it keeps the credential out of the process list the same way.

Validation

• mint broken-links: passes.
• The documented config matches what the kernel/cli branch writes, checked by running the built binary against a throwaway HOME.
• --header-file checked against mcp-remote 0.14.3: an absolute path logs Loaded 1 header(s) and Using custom headers: Authorization; a leading ~ is not expanded and fails with ENOENT.
• Both config paths and the env field confirmed against Antigravity's own MCP documentation.
• mcp-remote against the documented URL was run directly: it discovers the authorization server, registers a client, and reaches the authorization step. The browser consent step and the flow inside Antigravity itself were not driven.

🤖 Generated with Claude Code

---

Note

Low Risk
Documentation-only change to MCP client setup instructions; no application code or auth logic is modified.

Overview
Updates the Google Antigravity MCP doc so the primary setup matches other clients: stdio through npx mcp-remote instead of a remote serverUrl entry that can OAuth successfully yet still hit 401 on initialize without a bearer token.

The opening Warning becomes a Note that explains why stdio is recommended. Manual JSON examples now use command / args, including --static-oauth-client-metadata so the consent screen shows Antigravity, plus guidance to drop serverUrl if upgrading an old install.

Connect steps change to reload installed servers and authorize in the browser mcp-remote opens, with tokens under ~/.mcp-auth (replacing Antigravity’s paste-the-code OAuth flow). The API key section is reframed for headless use and documents --header-file with a locked-down header file instead of embedding the key in config or process args.

^{Reviewed by Cursor Bugbot for commit 3b59572. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Kernel	🟢 Ready	View Preview	Sep 23, 2026, 1:16 AM

💡 Tip: Enable Automations to automatically generate PRs for you.

[cursor]

Risk level: Very Low

This pull request changes one documentation page, reference/mcp-server/clients/antigravity.mdx (+31 / −16). It updates the documented Antigravity MCP setup from a remote serverUrl entry to an npx mcp-remote stdio command, and it rewrites the API-key example to read a mode-600 header file via --header-file.

No application code, infrastructure, auth implementation, shared libraries, or build config changed. There is no CODEOWNERS file, so code-owner review is not required. No prior approval is on the PR.

Approving.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Risk level: Very Low

This pull request changes one documentation page, reference/mcp-server/clients/antigravity.mdx (+31 / −16). The page is Mintlify reference content for connecting Google Antigravity to the Kernel MCP server. The diff replaces the remote serverUrl example with an npx mcp-remote stdio command and rewrites the API-key example to read a mode-600 header file via --header-file.

No application code, infrastructure, authentication implementation, shared libraries, schema, or build config changed. There is no CODEOWNERS file, so code-owner review is not required.

This automation already approved the current commit (efd058b). Risk is unchanged, so this run does not add another approval.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[robertjamesprior]

Pushed 3b59572 to keep this in step with kernel/cli#265, which picked up --static-oauth-client-metadata in review.

Without it, mcp-remote registers as MCP CLI Proxy and the Kernel consent screen asks the user to trust that name rather than Antigravity. Confirmed by reading back mcp-remote's stored client_info.json: MCP CLI Proxy without the flag, Antigravity with it. The manual-config block now matches what the CLI writes, and carries a line explaining the flag.

Left out of the API-key example on purpose — that path authenticates with the header and never reaches a consent screen, so the flag would be dead weight there.

mint broken-links still passes.

[cursor]

Risk level: Very Low

This pull request still changes one documentation page, reference/mcp-server/clients/antigravity.mdx (+39 / −16). The commit since the existing approval (3b59572) adds --static-oauth-client-metadata with client_name set to Antigravity, plus one sentence explaining that the consent screen would otherwise show MCP CLI Proxy.

No application code, infrastructure, authentication implementation, shared libraries, schema, or build config changed. There is no CODEOWNERS file, so code-owner review is not required.

This automation already approved the PR on efd058b. The new commit does not raise the risk, so the approval stands and this run does not add another approval.

  

_{Sent by Cursor Automation: Assign PR reviewers}