> ## Documentation Index > Fetch the complete documentation index at: https://docs.xpander.ai/llms.txt > Use this file to discover all available pages before exploring further. # Set up laptops with xpander-connect > Install xpander-connect on your team's computers so Claude Code, Codex and OpenCode use your AI Gateway and every AI client gets your MCP address, signed in as each person, with settings your admins control. xpander-connect is a small app for your team's computers. It signs each person in to your organization's AI Gateway, points their AI coding clients at it, adds your organization's MCP address to their AI clients, and keeps those settings in place. Your admins decide which clients it sets up. ## How it works 1. You install xpander-connect on a computer, by hand or with your device management software (Jamf, Intune and others). It also comes inside xpander Desktop. 2. The person signs in once: xpander-connect shows a short code, and they approve it in xpander in their browser. 3. xpander-connect sets up the clients your organization chose. Model calls from those clients run as that person: on the models your organization enabled for them, within their budgets, and they show under their name in Logs. The MCP entry gives them their own skills from the Skills registry ([MCP gateway](https://docs.xpander.ai/run/integrations/mcp-gateway.md)). No key is ever put in an installer or a device management profile. Every computer signs in on its own. ## What it sets up | Client | Model calls through the AI Gateway | MCP address | | - | - | - | | Claude Code | `~/.claude/settings.json`: the gateway address and `xpander-connect token` as the key helper | `xpander` entry in `~/.claude.json`, signed in by xpander-connect ([One sign-in](#one-sign-in-for-the-mcp-gateway)) | | Codex | `~/.codex/config.toml`: an `xpander` model provider | `[mcp_servers.xpander]` in `~/.codex/config.toml` | | OpenCode | `~/.config/opencode/opencode.json`: an `xpander` provider | `xpander` entry under `mcp` in the same file | | Cursor | Set in Cursor's own model settings | `xpander` entry in `~/.cursor/mcp.json` | | Claude Desktop | With its own configuration profile: set the gateway address and the credential helper `xpander-connect` with the argument `token` | Added by the person: Settings > `Connectors` > `Add custom connector` | xpander-connect only writes its own entries and keeps a one-time backup of each file it changes. When an admin turns a client off, xpander-connect removes what it wrote there; settings a person made themselves stay. ## One sign-in for the MCP gateway On a computer signed in with xpander-connect, Claude Code reaches your organization's MCP address without asking the person to sign in again. When Claude Code connects, xpander-connect hands it a short-lived MCP sign-in made from the computer's own sign-in. Nothing is stored in a file, and it works only while that computer is signed in: when the person runs `xpander-connect logout`, an admin chooses **Remove client**, or the person leaves the organization, it stops at once and Claude Code asks for the browser sign-in instead. * It is on by default. Turn it off for everyone, or only for some groups, under **Platform > AI governance > AI tool clients**, `AI tools on clients`: **One sign-in for the MCP gateway** on the **Everyone** row or on a group override. A group can only turn it off. * An access policy can turn it off for a person or a group too: deny `feature:Use` on the resource `feature/connect.mcp_one_sign_in`. It applies once **Features** is enforced for your organization. * Calls made this way run as the person, with their own skills and approvals, and show in the audit log under their name and the AI client they used. Each one sign-in, and each refusal with its reason, is recorded in the audit log. * If one sign-in is off, refused or not reachable, Claude Code simply opens the company sign-in in the browser, as it does without xpander-connect. * Cursor, Codex and OpenCode sign in to the MCP address once in the browser. * It works the same on xpander cloud, Hybrid and Air-Gapped installs where people sign in to the AI Gateway with xpander-connect. ## Your organization's skills in Claude Code xpander-connect keeps your organization's published skills in Claude Code on each computer, so people get them without adding anything. Each skill from the Skills registry that the person may use is written to its own folder, `~/.claude/skills/xpander-/`, with its `SKILL.md` and the text files that come with it, and Claude Code uses it like any other skill. * It updates when a skill changes, removes a skill when it leaves the person's library, and puts back a skill someone changed by hand. It checks when the person signs in and every 30 minutes. * Only folders xpander-connect created are ever changed or removed. The person's own skills, and a folder of the same name they made themselves, are never touched. * If xpander cannot be reached, or one skill cannot be read right now, the skills already on the computer stay as they are. * It is on by default. Turn it off for everyone, or only for some groups, under **Platform > AI governance > AI tool clients**, `AI tools on clients`: **Organization skills** on the **Everyone** row or on a group override. A group can only turn it off. Turning it off removes the skills xpander-connect wrote. * No skills are written for a person whose Claude Code your organization set to be left alone. * An access policy can turn it off for a person or a group too: deny `feature:Use` on the resource `feature/connect.skills_sync`. It applies once **Features** is enforced for your organization. * Admins see, for each computer, which of your organization's skills it has under **Clients** (`Organization skills`). * It works the same on xpander cloud, Hybrid and Air-Gapped installs. ## Skills people make Claude Code also loads skills a person writes by hand in `~/.claude/skills`. Your organization chooses what xpander-connect does with them: | Rule | On the computer | | - | - | | **Allow** (default) | Nothing is looked at or reported. | | **Report** | Each skill's folder name and a fingerprint of its `SKILL.md` are reported to your organization. Its content never leaves the computer. | | **Block** | Reported, and moved out of Claude Code into xpander-connect's own folder, so nothing is lost. Lifting the rule puts them back, except one whose name was used again, which stays aside and is reported. | The skills xpander-connect keeps in Claude Code for your organization are never touched. To share a skill with the team, people ask their AI client to register it to the skill library through the [MCP gateway](https://docs.xpander.ai/run/integrations/mcp-gateway.md#add-a-skill-from-the-client), where your organization's approval rules apply. Skills inside a repository's own `.claude/skills` folder are not checked. ## Set up a computer by hand Install it from your xpander. On an Air-Gapped or self-hosted install, the command comes from that install and the computer signs in there: ```bash theme={"dark"} curl -fsSL https://chat.xpander.ai/desktop/connect/install.sh | sh # xpander cloud, macOS and Linux curl -fsSL https:///desktop/connect/install.sh | sh # your own install ``` On Windows, in PowerShell: `irm https:///desktop/connect/install.ps1 | iex`. The same commands, with your address filled in, are on **Platform > AI governance > MCP gateway** under **Install on one computer**, and on your install's `/desktop/` page. Each download is checked against the checksum your xpander publishes. Then: ```bash theme={"dark"} xpander-connect login # opens your browser; approve the code shown xpander-connect setup # sets up the clients your organization chose xpander-connect install-agent # keeps them signed in and set up, starting at every login ``` `xpander-connect status` shows who is signed in and what the background agent last did. `xpander-connect logout` signs the computer out. The background agent renews the sign-in before it expires, checks your organization's settings every 30 minutes and puts back any setting it manages that was changed, and checks for a new xpander-connect release every 6 hours. `xpander-connect update` checks now. Each release is signed, and xpander-connect installs only a release whose signature and checksum match. The copy inside xpander Desktop is updated with Desktop. ## Which xpander it talks to By default xpander-connect talks to xpander cloud (`https://chat.xpander.ai`). Installed with the command from your own install, it already talks to that install. To set it by hand on one computer, run `xpander-connect config set-server https://` once (`xpander-connect login --server https://` saves it too, and `xpander-connect config clear-server` goes back to xpander cloud). People in an organization with a Hybrid install keep the default: their computers sign in to xpander cloud. To set the address for every managed computer: | Platform | Where | | - | - | | macOS | `ServerUrl` in a configuration profile for the domain `ai.xpander.desktop` | | Windows | `ServerUrl` (string) under `HKLM\SOFTWARE\Policies\xpander\Desktop` | | Linux | `{"ServerUrl": "https://..."}` in `/etc/xpander/desktop.json` | The same setting configures xpander Desktop, so one profile covers both. An address set this way cannot be changed on the computer. To check what a computer uses, run `xpander-connect config show`. ## Deploy with device management More settings sit next to `ServerUrl`, in the same profile, registry key or file: | Setting | Values | What it does | | - | - | - | | `ConnectAutoSetup` | `true` / `false` | After the person signs in, set up their clients and start the background agent without asking. | | `ConnectEnforce` | `report` (default) / `lock` | `lock` also pins Claude Code to your gateway for every account on the computer, so it cannot be pointed elsewhere. | | `ConnectMcp` | `true` / `false` | Add your organization's MCP address to Claude Code, Cursor, Codex and OpenCode as `xpander`. | | `ConnectMcpLockdown` | `true` / `false` | Keep `xpander` as the only MCP entry in each client. Other entries are set aside and come back when this is turned off. | | `ConnectAutoUpdate` | `true` (default) / `false` | `false` leaves updates to your device management. | Run `xpander-connect managed apply` as an administrator from your device management software (a Jamf policy script, an Intune platform script). It applies the settings that need administrator rights and is safe to run on every check-in; it removes them again when the computer no longer has the profile. Ready-made Jamf and Intune packs with these settings and an install script are on [Set up AI clients](https://docs.xpander.ai/run/integrations/mcp-gateway-setup.md). ## Choose which clients it sets up In xpander, go to **Platform > AI governance > AI tool clients**. Under `AI tools on clients`, the **Everyone** row sets, for each client (Claude Code, Codex, OpenCode, Claude Desktop, Cursor), whether xpander-connect sets it up, a **Default model**, **Enforce** (**Report** or **Lock**), **One sign-in for the MCP gateway**, **Organization skills** and **Skills people make** (**Allow**, **Report** or **Block**). **Add group override** makes a group stricter than the organization: a group can skip a client, require **Lock**, turn one sign-in or organization skills off, or ask for a stricter rule for skills people make, never the opposite. **Connect clients** shows the setup steps and the device management settings for your organization, ready to copy. ![AI tool clients page with the Everyone and Support rules under AI tools on clients, and the Clients list below](https://mintcdn.com/xpanderai-099931d1/G1LXBCidjD2Wd_jo/images/run/llm-gateway/xpander-connect/ai-tool-clients-page.png?fit=max\&auto=format\&n=G1LXBCidjD2Wd_jo\&q=85\&s=a305836b4073c16d07859a90d392ebec) AI tool clients: the rule for everyone, a stricter group override, and the clients signed in. Shown with sample data. ![Group override panel with switches for each AI client, Enforce, Skills people make, Cloud Claude Code, Run Claude Code, Default model, Organization skills and One sign-in for the MCP gateway](https://mintcdn.com/xpanderai-099931d1/G1LXBCidjD2Wd_jo/images/run/llm-gateway/xpander-connect/ai-tool-clients-rules.png?fit=max\&auto=format\&n=G1LXBCidjD2Wd_jo\&q=85\&s=337eba72dbb09c2eedbda0c56297b1ee) A group override: each setting can only be stricter than the rule for everyone. Shown with sample data. ## Computers your admins manage Under **Clients** on the same page, admins see every computer signed in through xpander-connect: its owner, its system and xpander-connect version, when it last reported, which clients xpander-connect set up and any that failed, which of your organization's skills it keeps in Claude Code (`Organization skills`, by name only), the skills people made on it by hand under `Skills made on this client` (name and fingerprint, and which are set aside), and under `Other MCP servers` every other MCP entry found in its AI clients (the client, the entry's name and the host or program it runs, never its address details or keys). **Remove client** signs it out of the gateway right away, and it cannot sign in again until an admin chooses **Restore client**. Nothing on the computer is deleted. People never see these entries in their own settings. ![Client panel for omer-thinkpad with status, member, system, version, the clients set up with a failed Codex setup, Organization skills and a skill set aside under Skills made on this client](https://mintcdn.com/xpanderai-099931d1/G1LXBCidjD2Wd_jo/images/run/llm-gateway/xpander-connect/ai-tool-clients-client-panel.png?fit=max\&auto=format\&n=G1LXBCidjD2Wd_jo\&q=85\&s=ad325ec3524c899d2e6b7cdb650db450) One client opened: what xpander-connect set up, what failed, and the skills kept or set aside. Shown with sample data. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.