# Set up Bento

Bento gives agents access to remote workspace files and a catalog of text, image,
and video models through one login. Use it from your own computer with the CLI
and skill, or connect an MCP client.

Choose by what you can do, not by which product you are. If you can run shell
commands on the user's computer, install the CLI and skill. If you cannot, skip
to [Add MCP for your client](#add-mcp-for-your-client).

## Install the CLI

Install [Node](https://nodejs.org/en/download) 22.20 or newer with npm, using the
machine's runtime manager if it has one. Check `node --version` and `npm --version`.

```sh
npm i -g @bentoai/cli
bento --version
bento --help
```

If `bento` is missing from PATH, inspect `npm prefix -g`; use a user-owned prefix
rather than `sudo`. Reuse a working install, or run `bento upgrade` when an upgrade
is needed. To run a local agent prompt, use `bento -p "your task"`.

## Install the skill

```sh
bento skills install --agent <id>
```

Replace `<id>` with the installer id of the client you run in: `claude-code`,
`codex`, `cursor`, or `openclaw`. Use `universal` for any other agent. Repeat
`--agent <id>` for additional clients. The CLI installs its bundled skill
without repository access and refreshes it on upgrade. Read the installed bento
skill before using Bento for the task.

## Sign in when the task needs it

Reuse a working login. Sign in only when the task needs Bento workspace access
or model billing. Choose by what you have:

1. **Your client can add MCP servers and the user has a browser (default):** add
   Bento with the client instructions below, then complete its OAuth flow. To
   give the CLI the same identity, follow “Sign the CLI in from MCP”.
2. **You can read the user's email:** run `bento login --email <address>`, read
   Bento's emailed code, then run `bento login --code XXXX-XXXX`. If you cannot
   read the mailbox, ask the user to read the code back. For a new signup, add
   `--name <name> --workspace-name <name>` to the code command when needed.
3. **Otherwise:** run `bento login`, keep it running, and have the user approve
   the displayed code at its browser verification URL. Use `--no-browser` when
   automatic browser opening is unavailable.

If email sign-in reports several workspaces, ask which one and repeat the code
command with `--workspace <slug>`; the code survives that refusal. If a code
expires, start a fresh login. The CLI saves the login itself; do not write its
configuration by hand.

These instructions are published at https://heybento.ai/agents.md and use the
production API https://ctl.bento.ing and MCP server https://mcp.bento.ing/.
For an explicitly requested custom server, keep `--api-url <origin>` consistent
through login and later commands.

## Add MCP for your client

Use Streamable HTTP. OAuth issues the same kind of human key as CLI login;
current membership and role determine access. Configure only the user's client.

### Claude Code

```sh
claude mcp add --transport http bento https://mcp.bento.ing/
claude mcp login bento
```

When the CLI is already signed in, use this add command instead of OAuth:

```sh
claude mcp add --transport http bento https://mcp.bento.ing/ \
  --header "Authorization: Bearer $(bento token)"
```

### Codex

```sh
codex mcp add bento --url https://mcp.bento.ing/
codex mcp login bento
```

For an existing CLI login, Codex reads a bearer from an environment variable:

```sh
codex mcp add bento --url https://mcp.bento.ing/ --bearer-token-env-var BENTO_MCP_TOKEN
BENTO_MCP_TOKEN=$(bento token) codex
```

Launch Codex with that variable each time this configuration is used. The value
stays in the process environment; do not echo it or save it to a shell profile.

### Cursor

Merge this entry into `mcpServers` in `~/.cursor/mcp.json`, preserving other
servers. Open Cursor's MCP settings and complete Bento's OAuth sign-in.

```json
{
  "mcpServers": {
    "bento": { "url": "https://mcp.bento.ing/" }
  }
}
```

If the CLI is already signed in, this command merges the entry with its bearer
header directly into Cursor's own configuration without printing the key:

```sh
node --input-type=module <<'NODE'
import { execFileSync } from 'node:child_process';
import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
import { homedir } from 'node:os';
import { join } from 'node:path';
const file = join(homedir(), '.cursor', 'mcp.json');
const config = existsSync(file) ? JSON.parse(readFileSync(file, 'utf8')) : {};
const key = execFileSync('bento', ['token'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'inherit'] }).trim();
config.mcpServers ??= {};
config.mcpServers.bento = {
  url: 'https://mcp.bento.ing/',
  headers: { Authorization: `Bearer ${key}` },
};
mkdirSync(join(homedir(), '.cursor'), { recursive: true });
writeFileSync(file, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
NODE
```

### OpenClaw

```sh
openclaw mcp add bento --url https://mcp.bento.ing/ --transport streamable-http --auth oauth
```

Complete sign-in from OpenClaw's MCP settings. For terminal OAuth, stop the
Gateway with `openclaw gateway stop`, run `openclaw mcp login bento`, then restart
it with `openclaw gateway start`.

When the CLI is already signed in, use this add command instead of OAuth:

```sh
openclaw mcp add bento --url https://mcp.bento.ing/ --transport streamable-http \
  --header "Authorization: Bearer $(bento token)"
```

### ChatGPT

In ChatGPT's app/connector settings, enable developer mode if required, create a
custom MCP connector named Bento at `https://mcp.bento.ing/`, choose OAuth, and
complete consent.

### Any other MCP client

Add a Streamable HTTP server named `bento` at `https://mcp.bento.ing/` and
complete its OAuth sign-in. If the client takes request headers instead of OAuth
and the CLI is signed in, put `Authorization: Bearer $(bento token)` directly into
the client's configuration.

### Sign the CLI in from MCP

Start this as a continuing process, keeping it alive while you approve:

```sh
bento login --no-browser --json
```

Read its `user_code` from the `pending_user` event. In the signed-in Bento MCP
session, call `approve_cli_login` with `{"userCode":"<that user_code>"}`. Wait for
the CLI's `approved` event and exit. Another signed-in CLI can instead run
`bento device approve --user-code <code>`.

## Check access

```sh
bento whoami
```

For workspace operations, inspect `bento workspace ls --json` and select the
intended slug with `bento workspace use <slug>` or an advertised per-command
`--workspace <slug>`. Ask when the task does not identify which workspace to use.
On `onboarding_required`, follow the [workspace onboarding workflow](https://docs.bento.ing/getting-started.md#finish-workspace-onboarding).

Never run `bento token` on its own: capture it directly for the client's
configuration or process environment. Never print the key or put it in a
transcript, log, or file other than the client's own configuration.