Your first five minutes

One command, in the agent you already have open. It carries no key — the server advertises OAuth and your agent picks it up from there.

Any other MCP client: point it at https://sprawl.to/api/mcp over streamable HTTP. Both commands above connected in about two seconds when we timed them against production.

If your agent can open a browser, there is nothing else to do. The first time it calls a Sprawl tool, the server answers with the address of its authorization server, your agent registers itself, and a consent screen opens in your browser. You approve it once. No key to create, copy, or paste anywhere.

It is OAuth 2.1 with PKCE and dynamic client registration, so a client that has never seen Sprawl before can complete the handshake with nothing pre-arranged. The two documents that make that work are public and unauthenticated, if you or your agent want to read them first:

• /.well-known/oauth-protected-resource — names the endpoint and who authorizes it
• /.well-known/oauth-authorization-server — the authorization endpoint, registration, and S256

You will need a Sprawl account to approve the consent screen — creating one is free, takes no card, and starts with $3 of usage.

CI, a container, a -p session with nowhere to open a consent screen — those cannot finish an OAuth handshake, so they carry a bearer key instead. Create one under Settings → API Keys once you have an account. Keys are prefixed sprawl_sk_ so they are easy to recognize in a config file.

Accepting the dialog's defaults is enough to stand up an operation. It was not always: a default key used to be refused at the last step, after the blueprint was already designed. That is fixed, and a test against live production holds it fixed.

The two are not one command with a different verb. Codex writes TOML, and its only auth flag takes the name of an environment variable rather than the key itself — so the JSON below has no Codex equivalent.

Any other MCP client that accepts an HTTP server config takes this shape. One warning worth having in advance: adding a server by hand-editing this file leaves it ⏸ Pending approval in Claude Code until you launch the interactive TUI once. The claude mcp add command above does not have that step, which is why it is the one we lead with.

{
  "mcpServers": {
    "sprawl": {
      "type": "http",
      "url": "https://sprawl.to/api/mcp",
      "headers": { "Authorization": "Bearer sprawl_sk_..." }
    }
  }
}

To confirm a key works before you wire anything up:

curl -s https://sprawl.to/api/mcp \
  -H "Authorization: Bearer sprawl_sk_..." \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

A machine-readable descriptor — tools, auth, prompts and pricing — is served without auth at /.well-known/mcp/server-card.json.

Nothing to learn first. When we walked this on production, the sentence typed was:

“set up support for my SaaS: triage the inbox, draft replies, ask me before sending.”

What came back, in order:

• It asked one question. Which platform the support inbox lives in — the one thing it could not guess — and proposed a model for the job with the cost reasoning attached. It created nothing yet.
• It proposed a blueprint. The whole operation as one reviewable object: the agents, their skills, their schedules, the goals, and the accounts each one needs.
• You approve, and it provisions. Our walk produced one agent, one skill, one knowledge entry, two goals and one automation, in a single atomic step. Nothing exists until that approval.

Four minutes and four turns, start to finish. You are never asked to know what an “operation”, a “fleet” or a “grant” is — those words appear in the summary your agent writes back, not in the questions it asks you.

This is the step your coding agent cannot do for you, and we would rather you heard it here than found it out. A provisioned operation is not yet a running one. Each agent acts as an account you grant it, and granting one means completing that provider's own sign-in — Google's consent screen, Slack's, Stripe's. That happens in a browser.

Your agent hands you the link rather than pretending: it returns the connect URL and stops. Until you follow it, runs are skipped rather than silently failing, and the run report says so in as many words — “Gmail is not connected. I cannot access the support inbox at all this run.”

One granted account can serve more than one agent — each holds its own scoped grant to it, so a support agent and a marketing agent can share one sign-in and still only ever see their own mailbox — and anything you are not ready to connect stays parked until you are.

Once the fleet is running you close the session and it keeps going. The two questions you will actually ask are typed, not guessed — Sprawl publishes them as named prompts, which a host like Claude Code renders as slash commands:

• /what-happened — What happened? Every automation’s runs, what failed and why in the provider’s own words, how long they took, what each one cost in dollars, and anything that was due and never fired.
• /what-needs-me — What needs me? What is waiting on your approval, what is past due, and what expired unactioned — so the answer to “is anything stuck?” is a question you type, not a tool name you guess.

This is the half of the walk that failed the first time. Asking a fresh session “what happened?” in plain English reached Sprawl zero times — the right tools existed and had to be guessed by name. They are named questions now. When we re-measured over six fresh sessions, a session that knew the published names reached a Sprawl tool within its first few calls every time; one that only had the bare tool name missed on the first lookup every time.

If you keep procedures as SKILL.md files — the portable format Claude Code, Codex and Cursor all read — your agent can hand one to Sprawl instead of rewriting it. Point it at a public GitHub SKILL.md or a skills.sh page and Sprawl saves it as one of your skills, then grants it to whichever agent should follow it. Skills Sprawl learns from your own runs stay in Sprawl for now — there is no export back out to a file yet.

There is no subscription. Every account starts with $3 of usage, each run draws its own price from that balance, and you add more whenever you want — from $5, never expiring. Designing an operation in the builder is free; your balance goes to the work your agents do, not to describing it.

sprawl_get_usage returns the remaining balance in dollars, what has been spent this month, and the billing page to add more. Adding balance is the account owner's action — an agent can surface the link and cannot charge a card. When the balance runs out, runs pause rather than billing on.

Sprawl also exposes Agentic Commerce Protocol endpoints (the open standard by OpenAI and Stripe) for top-ups, so an agent can run a standards-based checkout itself: a public feed at GET /api/acp/feed, and create / re-price / retrieve / cancel at /api/acp/checkout_sessions. Payment completion via Shared Payment Token is not yet enabled — until it is, a session can be created and priced but not paid, and the account owner adds balance from the billing page.