Connect to Conductor¶

Public instructions for agents with lab access (Bitwarden/bws, secret-gate, or SSH to konstant). Never put the auth token value in chat, commits, or vault notes.

Live page: https://conductor-konstant.hectorsanchez.eu/connect Raw markdown: https://conductor-konstant.hectorsanchez.eu/connect.md

What this is¶

Conductor is a knowledge base and a minimal MCP transport. It serves organizational documentation (multi-line org: Portfolio, Product, Software, Editorial, Services, Operate) from docs/. The compiler has been archived to archive/compiler-v1/.

Conductor no longer performs plan authorization, corpus compilation, or execution verification. It is a documentation server with a minimal MCP transport.

Available MCP tools:

onboard() — workspace setup instructions: folder structure, repo clone, prerequisites, MCP config

Archived tools (no longer available):

All compiler-era tools have been archived to archive/compiler-v1/. These include: list_business_lines, list_stages, list_inventories, list_roles, describe_handoffs, validate_consult_request, prepare_estate_context, start_conversation, follow_up, consult_plan, authorize, complete_authorized_work, prepare, converse, feedback, submit_proposal, get_proposal_status, implement_approved_proposal, submit_experience, review_experience_candidates, get_learning_review_status, run_learning_review_if_due, list_improvement_candidates, draft_candidate_proposal, get_organization_onboarding_questions, compile_candidate_organization_profile.

Conductor does not mutate project state. Notion owns the Initiative and workstream state; agents update it directly. Line tools own their production artifacts.

Endpoints¶

Purpose	URL
MCP	`https://conductor-konstant.hectorsanchez.eu/mcp`
Health	`https://conductor-konstant.hectorsanchez.eu/health`
Docs (MkDocs)	`https://conductor-docs.hectorsanchez.eu`
This guide	`https://conductor-konstant.hectorsanchez.eu/connect`
Raw markdown	`https://conductor-konstant.hectorsanchez.eu/connect.md`

Auth on /mcp: Authorization: Bearer <token> or ?key=<token>.

/health, /connect, and /connect.md are unauthenticated.

Secret¶

Bitwarden Secrets Manager key name: CONDUCTOR_MCP_AUTH_TOKEN
Authoritative value store: Bitwarden Secrets Manager only

Do not echo the value into agent transcripts when avoidable; use it only to configure the client or a local env var.

Retrieve the secret¶

Authoritative secret values live only in the secret provider (Bitwarden Secrets Manager). Runtime may inject a provider-resolved value into process memory. Documentation must not establish any other durable secret source (including host .env files).

A — Windows PowerShell + secret-gate (this lab PC)¶

powershell . "D:\Workspace\_repos\tools\secret-gate\secret-gate.ps1" $token = ((bws secret list | ConvertFrom-Json) | Where-Object { $_.key -eq "CONDUCTOR_MCP_AUTH_TOKEN" }).value if (-not $token) { throw "CONDUCTOR_MCP_AUTH_TOKEN not found in Bitwarden; create or update that secret in the provider, then retry" } Write-Host "got CONDUCTOR_MCP_AUTH_TOKEN (len=$($token.Length))"

Cached session path: $env:LOCALAPPDATA\secret-gate\session.json (BW_SESSION, BWS_ACCESS_TOKEN).

B — Linux `bws` (EliteBook / VPS-style)¶

bash export PATH="$HOME/.local/bin:$PATH" source ~/.local/state/secret-gate/session.env 2>/dev/null || true KEY=$(bws secret list -o json | python3 -c ' import json,sys wanted="CONDUCTOR_MCP_AUTH_TOKEN" for s in json.load(sys.stdin): if s.get("key")==wanted: print(s.get("value","")) break ') if [ -z "$KEY" ]; then echo "CONDUCTOR_MCP_AUTH_TOKEN not found in Bitwarden; create or update that secret in the provider, then retry" >&2 exit 1 fi echo "got CONDUCTOR_MCP_AUTH_TOKEN (len=${#KEY})"

If the session is cold, run secret-gate / Bitwarden unlock first (see konstant-server runbooks/02-bitwarden.md), then retry B.

If Bitwarden secret missing¶

Stop. Create or update the Secrets Manager secret named CONDUCTOR_MCP_AUTH_TOKEN in Bitwarden, then retry A or B. Do not read a host .env file, SSH into a host to scrape a durable copy, or treat any other location as authoritative for the value.

Configure clients¶

Replace <CONDUCTOR_MCP_AUTH_TOKEN> with the token retrieved from Bitwarden. Never paste the token into chat — set it as an environment variable and reference it.

Cursor¶

.cursor/mcp.json:

json { "mcpServers": { "conductor": { "url": "https://conductor-konstant.hectorsanchez.eu/mcp", "headers": { "Authorization": "Bearer ${CONDUCTOR_MCP_AUTH_TOKEN}" } } } }

OpenCode¶

Add via CLI (recommended — no manual JSON editing):

```bash

Retrieve token first¶

. "D:\Workspace_repos\tools\secret-gate\secret-gate.ps1" $token = ((bws secret list | ConvertFrom-Json) | Where-Object { $_.key -eq "CONDUCTOR_MCP_AUTH_TOKEN" }).value

Add MCP server (CLI uses KEY=VALUE format, not KEY: VALUE)¶

opencode mcp add conductor \ --url https://conductor-konstant.hectorsanchez.eu/mcp \ --header "Authorization=Bearer $token" ```

Or via JSON config (opencode.json or ~/.config/opencode/opencode.json):

json { "mcpServers": { "conductor": { "url": "https://conductor-konstant.hectorsanchez.eu/mcp", "headers": { "Authorization": "Bearer ${CONDUCTOR_MCP_AUTH_TOKEN}" } } } }

Claude Code (Anthropic)¶

.mcp.json in your project root or ~/.claude/.mcp.json:

json { "mcpServers": { "conductor": { "type": "url", "url": "https://conductor-konstant.hectorsanchez.eu/mcp", "headers": { "Authorization": "Bearer ${CONDUCTOR_MCP_AUTH_TOKEN}" } } } }

Or with the Claude Code CLI:

bash claude mcp add conductor \ --url https://conductor-konstant.hectorsanchez.eu/mcp \ --env CONDUCTOR_MCP_AUTH_TOKEN

Codex (OpenAI)¶

Add via CLI (recommended — reads token from environment variable):

```bash

Retrieve token first¶

. "D:\Workspace_repos\tools\secret-gate\secret-gate.ps1" $env:CONDUCTOR_MCP_AUTH_TOKEN = ((bws secret list | ConvertFrom-Json) | Where-Object { $_.key -eq "CONDUCTOR_MCP_AUTH_TOKEN" }).value

Add MCP server (--bearer-token-env-var is cleaner than inline headers)¶

codex mcp add conductor \ --url https://conductor-konstant.hectorsanchez.eu/mcp \ --bearer-token-env-var CONDUCTOR_MCP_AUTH_TOKEN ```

Or via JSON config (codex.json or ~/.codex/config.toml):

json { "mcpServers": { "conductor": { "url": "https://conductor-konstant.hectorsanchez.eu/mcp", "headers": { "Authorization": "Bearer ${CONDUCTOR_MCP_AUTH_TOKEN}" } } } }

OpenClaw¶

openclaw.json:

json { "mcpServers": { "conductor": { "url": "https://conductor-konstant.hectorsanchez.eu/mcp", "headers": { "Authorization": "Bearer ${CONDUCTOR_MCP_AUTH_TOKEN}" } } } }

Cline (VS Code extension)¶

Cline MCP settings (VS Code settings.json or Cline UI):

json { "cline.mcpServers": { "conductor": { "url": "https://conductor-konstant.hectorsanchez.eu/mcp", "headers": { "Authorization": "Bearer ${CONDUCTOR_MCP_AUTH_TOKEN}" } } } }

Windsurf¶

windsurf.json or .windsurf/mcp.json:

json { "mcpServers": { "conductor": { "url": "https://conductor-konstant.hectorsanchez.eu/mcp", "headers": { "Authorization": "Bearer ${CONDUCTOR_MCP_AUTH_TOKEN}" } } } }

Continue.dev (VS Code / JetBrains)¶

continue-config.json → MCP Servers section:

json { "mcpServers": [ { "name": "conductor", "url": "https://conductor-konstant.hectorsanchez.eu/mcp", "headers": { "Authorization": "Bearer ${CONDUCTOR_MCP_AUTH_TOKEN}" } } ] }

Any Streamable HTTP MCP client (query auth)¶

If your client does not support custom headers, use query parameter auth:

text https://conductor-konstant.hectorsanchez.eu/mcp?key=<CONDUCTOR_MCP_AUTH_TOKEN>

Test with curl:

```bash curl -fsS https://conductor-konstant.hectorsanchez.eu/health

expect: {"status":"ok","service":"conductor",...}¶

```

Smoke (must pass)¶

```bash export MCP_BASE="https://conductor-konstant.hectorsanchez.eu"

KEY from A or B above — do not paste into chat¶

curl -fsS "$MCP_BASE/health" curl -fsS "$MCP_BASE/connect.md" | head curl -sS -o /dev/null -w "%{http_code}\n" "$MCP_BASE/mcp" # expect 401 without auth curl -sS -X POST "$MCP_BASE/mcp" \ -H "Authorization: Bearer $KEY" \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -H "MCP-Protocol-Version: 2025-03-26" \ -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"connect-smoke","version":"0.0.1"}}}' ```

Expect: tools/list includes onboard. All compiler-era tools are archived and not available.

If public DNS fails on the agent host, use Tailscale Funnel with Host header:

bash curl -fsS -H 'Host: conductor-konstant.hectorsanchez.eu' \ https://konstant-server.tail64860f.ts.net/health

Docs site¶

Evaluate the org model at https://conductor-docs.hectorsanchez.eu (MkDocs on konstant).

References¶

Ref	Where
Source repo	`https://github.com/hector-sanchez-eu/conductor` (private)
Tracking issue	`https://github.com/hector-sanchez-eu/conductor/issues/1`
Konstant runbook	`https://github.com/hector-sanchez-eu/konstant-server` → `runbooks/12-conductor-konstant.md`
SSH handoff	konstant-server `runbooks/00-connect-from-any-machine.md`
Bitwarden	konstant-server `runbooks/02-bitwarden.md`
Workspace secret-gate	`D:\Workspace\_repos\tools\secret-gate\secret-gate.ps1`

Connect to Conductor¶

What this is¶

Endpoints¶

Secret¶

Retrieve the secret¶

A — Windows PowerShell + secret-gate (this lab PC)¶

B — Linux bws (EliteBook / VPS-style)¶

If Bitwarden secret missing¶

Configure clients¶

Cursor¶

OpenCode¶

Retrieve token first¶

Add MCP server (CLI uses KEY=VALUE format, not KEY: VALUE)¶

Claude Code (Anthropic)¶

Codex (OpenAI)¶

Retrieve token first¶

Add MCP server (--bearer-token-env-var is cleaner than inline headers)¶

OpenClaw¶

Cline (VS Code extension)¶

Windsurf¶

Continue.dev (VS Code / JetBrains)¶

Any Streamable HTTP MCP client (query auth)¶

expect: {"status":"ok","service":"conductor",...}¶

Smoke (must pass)¶

KEY from A or B above — do not paste into chat¶

Docs site¶

References¶

B — Linux `bws` (EliteBook / VPS-style)¶