@super-hands/connect

Connect the coding agents on this machine to your team's Superhands MCP server, in one command.

Superhands setup generates the command for you, credential included:

SUPERHANDS_MCP_TOKEN="…" npx -y @super-hands/connect@latest

It connects to https://app.superhands.ai/api/mcp unless SUPERHANDS_MCP_URL says otherwise — a command from a preview or local deployment carries that variable too.

What it does

• Cursor — merges the superhands server into ~/.cursor/mcp.json. Every other server in the file is preserved; a file that does not parse is left untouched. Restart Cursor and enable the server under Settings → MCP.
• Claude Code — registers the server through Claude Code's own CLI (claude mcp add, user scope). A new claude session connects on start.
• Codex — appends the superhands block to ~/.codex/config.toml, and only when no such block is there. Both the app and the CLI read that file.
• The skill — writes skills/superhands/SKILL.md under each connected client's own directory. It routes UI work through the team's guidance and carries no credential.

With no flags it connects every client it finds; --cursor, --claude or --codex narrow it to one. Re-running it later to pick up a newer skill needs no credential — see update, below.

Updating it

npx -y @super-hands/connect@latest update

Brings the skill on an already-connected machine up to whatever this build ships. It takes no token: it reads the endpoint and the credential back out of the configs the install wrote, so there is nothing to fetch from Superhands and nothing new is minted. It touches no MCP entry — the entry is how the credential was found, so it is already right.

A client counts as connected when its own config names the superhands server; anything else is skipped, and a machine with no Superhands entry at all is told to install first rather than half-connected. An installed skill at the same version or newer is left alone, so your own edits survive an update and the run says which files it left as they were. The same --cursor / --claude / --codex flags narrow it to one client.

Removing it

npx -y @super-hands/connect@latest uninstall

The exact inverse, in this order: it reads every Superhands credential on the machine out of the configs, hands each one back to the deployment that issued it, and only then removes the entries and the skill files. The other way round would delete the only copy of the credential needed to tell the server anything.

It removes only what this tool wrote — one key out of ~/.cursor/mcp.json, its own block out of ~/.codex/config.toml, and the Claude Code entry through claude mcp remove. Everything else in those files stays. Running it twice, or on a machine that was never connected, does nothing and says so; a machine that cannot reach the internet is still cleaned locally, with a warning that the credential is still live. The same --cursor / --claude / --codex flags remove one client and leave the rest.

What it does not do

It reads no repository, runs none of your code, and uploads nothing. The one secret it holds is the token in its own environment, and it is written only into the client configs above. The token can be revoked at any time from the Superhands MCP page.

This file is generated from lib/connect-client-entry.ts in the Superhands repository — the published bytes are that commit's, and are not minified.