From e86a109c40097341a0910e79fd280c3f1254698e Mon Sep 17 00:00:00 2001 From: robertjamesprior <83608739+robertjamesprior@users.noreply.github.com> Date: Tue, 22 Sep 2026 23:34:09 +0000 Subject: [PATCH 1/3] Document the antigravity MCP config as stdio via mcp-remote Antigravity's remote-server client can complete the OAuth flow and still send initialize without the bearer token, so the serverUrl config this page documented fails on first contact with 401 Unauthorized. Document the npx mcp-remote stdio entry instead, matching the Claude Desktop, Windsurf and Zed pages, and rewrite the connect steps for the flow it actually takes. The API-key section becomes the headless path rather than a workaround for broken OAuth, and passes the key through env so it stays out of the process list. Co-Authored-By: Claude Opus 5 --- reference/mcp-server/clients/antigravity.mdx | 36 ++++++++++++-------- 1 file changed, 21 insertions(+), 15 deletions(-) diff --git a/reference/mcp-server/clients/antigravity.mdx b/reference/mcp-server/clients/antigravity.mdx index 5bf0a94..858e86d 100644 --- a/reference/mcp-server/clients/antigravity.mdx +++ b/reference/mcp-server/clients/antigravity.mdx @@ -3,11 +3,9 @@ title: "Google Antigravity" description: "Connect Google Antigravity to the Kernel MCP server" --- - -Antigravity can complete the OAuth flow and still send `initialize` without the bearer token attached, which comes back as `401 Unauthorized` ([antigravity-cli#25](https://github.com/google-antigravity/antigravity-cli/issues/25)). - -If you hit that, [connect with an API key](#connect-with-an-api-key-workaround) instead of OAuth. - + +Kernel connects to Antigravity over stdio through `mcp-remote` rather than as a remote `serverUrl` server. Antigravity's remote-server client can complete the OAuth flow and still send `initialize` without the bearer token attached, which comes back as `401 Unauthorized` ([antigravity-cli#25](https://github.com/google-antigravity/antigravity-cli/issues/25)). `mcp-remote` runs the OAuth flow itself, so the token does not depend on that client. + ## Install with the Kernel CLI @@ -25,35 +23,43 @@ Alternatively, open the agent side panel, click the ellipsis (**…**) menu, and { "mcpServers": { "kernel": { - "serverUrl": "https://mcp.onkernel.com/mcp" + "command": "npx", + "args": ["-y", "mcp-remote", "https://mcp.onkernel.com/mcp"] } } } ``` -Antigravity uses `serverUrl` for remote servers; `url` and `httpUrl` are ignored. Reload the window to pick up the change. +If the entry previously used `serverUrl`, remove that key. Reload the window to pick up the change. ## Connect -Press **⌘/Ctrl ,** to open agent settings, go to the **Customizations** tab, and click **Authenticate** next to **kernel**. +Go to **Settings → Customizations**, scroll to **Installed MCP Servers**, and click the reload button. -Authorize access in the browser window that opens, then copy the authorization code, paste it back into the settings panel, and click **Submit**. Antigravity stores the tokens in `~/.gemini/antigravity/mcp_oauth_tokens.json` and refreshes them for you. +`mcp-remote` opens a browser window for you to authorize access. Once it completes, Kernel shows as connected in the **Installed MCP Servers** list. Tokens are cached under `~/.mcp-auth` and refreshed for you. -## Connect with an API key (workaround) +## Connect with an API key -Get a project-scoped Kernel API key from the [Kernel Dashboard](https://dashboard.onkernel.com/api-keys) and pass it as a header instead of authenticating. `kernel mcp install --target antigravity` always writes the OAuth config, so add the `headers` block by hand: +For headless or scripted use, where no browser is available to complete the OAuth flow, get a project-scoped Kernel API key from the [Kernel Dashboard](https://dashboard.onkernel.com/api-keys) and pass it as a header instead. `kernel mcp install --target antigravity` always writes the OAuth config, so add the `--header` argument by hand: ```json { "mcpServers": { "kernel": { - "serverUrl": "https://mcp.onkernel.com/mcp", - "headers": { - "Authorization": "Bearer YOUR_KERNEL_API_KEY" + "command": "npx", + "args": [ + "-y", + "mcp-remote", + "https://mcp.onkernel.com/mcp", + "--header", + "Authorization:${KERNEL_AUTH_HEADER}" + ], + "env": { + "KERNEL_AUTH_HEADER": "Bearer YOUR_KERNEL_API_KEY" } } } } ``` -Leave the **Authenticate** button alone when using this — Antigravity sends the header on every request, including `initialize`. +The key goes in `env` rather than inline in `args` so that it stays out of the process list, and the header value carries no space around the colon because `npx` mangles spaces inside `args` on some platforms. From efd058bba5bbb5e1359d994e67c30540aa6bf9cc Mon Sep 17 00:00:00 2001 From: robertjamesprior <83608739+robertjamesprior@users.noreply.github.com> Date: Tue, 22 Sep 2026 23:40:29 +0000 Subject: [PATCH 2/3] Use a header file for the antigravity API-key path mcp-remote stores a --header value literally; it does not expand ${VAR} from the env block, and Antigravity documents env for stdio servers without documenting substitution inside args. The documented form would have sent the placeholder as the header value. Use --header-file, which mcp-remote reads itself, so the credential works regardless of client substitution and stays out of the process list. Verified against mcp-remote 0.14.3: an absolute path loads the header, and a leading ~ is not expanded. Co-Authored-By: Claude Opus 5 --- reference/mcp-server/clients/antigravity.mdx | 25 +++++++++++++------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/reference/mcp-server/clients/antigravity.mdx b/reference/mcp-server/clients/antigravity.mdx index 858e86d..3a9a372 100644 --- a/reference/mcp-server/clients/antigravity.mdx +++ b/reference/mcp-server/clients/antigravity.mdx @@ -40,7 +40,17 @@ Go to **Settings → Customizations**, scroll to **Installed MCP Servers**, and ## Connect with an API key -For headless or scripted use, where no browser is available to complete the OAuth flow, get a project-scoped Kernel API key from the [Kernel Dashboard](https://dashboard.onkernel.com/api-keys) and pass it as a header instead. `kernel mcp install --target antigravity` always writes the OAuth config, so add the `--header` argument by hand: +For headless or scripted use, where no browser is available to complete the OAuth flow, authenticate with a project-scoped Kernel API key from the [Kernel Dashboard](https://dashboard.onkernel.com/api-keys) instead. `kernel mcp install --target antigravity` always writes the OAuth config, so wire this up by hand. + +Put the key in a header file that only you can read: + +```bash +mkdir -p ~/.kernel +install -m 600 /dev/null ~/.kernel/mcp-headers.txt +echo "Authorization: Bearer YOUR_KERNEL_API_KEY" > ~/.kernel/mcp-headers.txt +``` + +Then point `mcp-remote` at it: ```json { @@ -51,15 +61,14 @@ For headless or scripted use, where no browser is available to complete the OAut "-y", "mcp-remote", "https://mcp.onkernel.com/mcp", - "--header", - "Authorization:${KERNEL_AUTH_HEADER}" - ], - "env": { - "KERNEL_AUTH_HEADER": "Bearer YOUR_KERNEL_API_KEY" - } + "--header-file", + "/Users/you/.kernel/mcp-headers.txt" + ] } } } ``` -The key goes in `env` rather than inline in `args` so that it stays out of the process list, and the header value carries no space around the colon because `npx` mangles spaces inside `args` on some platforms. +Use an absolute path. `mcp-remote` opens the file directly, so a leading `~` isn't expanded and a relative path resolves against whatever directory Antigravity launched it from. + +`--header Authorization:...` takes the value inline instead, but the key then sits in the process arguments, where any other account on the machine can read it from the process list. From 3b595725c8b7409721808808c0a07330c63598fe Mon Sep 17 00:00:00 2001 From: robertjamesprior <83608739+robertjamesprior@users.noreply.github.com> Date: Wed, 23 Sep 2026 01:16:32 +0000 Subject: [PATCH 3/3] Name the OAuth client in the antigravity config Without static client metadata, mcp-remote registers as "MCP CLI Proxy", so the consent screen asks the user to trust that name rather than Antigravity. Matches what the CLI writes. The API-key example is left without the flag: that path authenticates with the header and never reaches a consent screen. Co-Authored-By: Claude Opus 5 --- reference/mcp-server/clients/antigravity.mdx | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/reference/mcp-server/clients/antigravity.mdx b/reference/mcp-server/clients/antigravity.mdx index 3a9a372..e534e77 100644 --- a/reference/mcp-server/clients/antigravity.mdx +++ b/reference/mcp-server/clients/antigravity.mdx @@ -24,7 +24,13 @@ Alternatively, open the agent side panel, click the ellipsis (**…**) menu, and "mcpServers": { "kernel": { "command": "npx", - "args": ["-y", "mcp-remote", "https://mcp.onkernel.com/mcp"] + "args": [ + "-y", + "mcp-remote", + "https://mcp.onkernel.com/mcp", + "--static-oauth-client-metadata", + "{\"client_name\":\"Antigravity\"}" + ] } } } @@ -32,6 +38,8 @@ Alternatively, open the agent side panel, click the ellipsis (**…**) menu, and If the entry previously used `serverUrl`, remove that key. Reload the window to pick up the change. +`--static-oauth-client-metadata` names the OAuth client. Without it, `mcp-remote` registers as **MCP CLI Proxy** and the Kernel consent screen asks you to trust that name instead of Antigravity. + ## Connect Go to **Settings → Customizations**, scroll to **Installed MCP Servers**, and click the reload button.