Connect your assistant

The studio's post-setup screen ("Reports & workflow") offers two independent cards once your first reports start collecting: Connect your AI assistant and Get your agency skills. Neither is required — you can open reports in the studio and set either up later — and connecting does not run anything: Ask about these clients and customize reports using their actual evidence.

Connect your AI assistant

Clicking Connect MCP opens a drawer with three things to choose, then one thing to copy:

1. Which assistant. Claude Code and Codex support a bearer token directly; Claude Desktop and ChatGPT do not expose a static header today (they require OAuth), so picking either shows the same guidance this page gives below plus a copyable "first workflow" prompt instead of a Connect button. "Other MCP client" covers anything else that accepts an mcpServers { url, headers } block.
2. Which client workspaces. Every workspace this drawer offers, all checked by default: Your assistant can read reports and evidence for these clients. Where assistant changes are enabled, it can make the changes your role allows: tools that spend your organization's allowance are limited to owners and admins, and destructive changes need a preview-and-confirm step. It never sends reports to anyone.
3. Connect MCP. Creates a personal access token scoped to exactly the workspaces you checked (see authentication.md's "Personal access token" section — what it can write depends on your current role, not a picker on this drawer) and shows the exact command or config file for your chosen assistant, with the token inserted — shown once. Copy it into your assistant's config now; the studio never shows the plaintext again.

Verify the connection

Paste this prompt into your assistant once it is configured:

Get my AEOMCP onboarding status and list the brand workspaces I can access.
Use stored data only. Do not refresh questions, generate paid analysis,
or send any reports.

The drawer polls for up to ten minutes and shows Connected to {assistant} for {workspace names}. the moment your assistant's first authenticated call lands. If ten minutes pass with no call, it says so — run the prompt again, or re-check your assistant's config against the command shown.

Get your agency skills

Clicking Download workflow skills (or Download workflow instructions for an assistant with no skills-folder convention — Claude Desktop, ChatGPT, or "Other MCP client") downloads a zip built for the assistant you picked: six ready-made workflow skills (prospect audit, weekly/monthly client report, gap analysis, content action plan, agency portfolio report), a per-client setup guide, and a sample report. See docs/mcp/clients/<id>.md for the exact guide your download carries, per assistant.

Downloading is not installing. The skill files only take effect once they are unzipped to your assistant's own skills folder (the path is named in the guide inside the zip, and summarized in the drawer right after your download starts) — or, for an assistant with no skills folder, once you paste its prompts into chat yourself.

Once you have extracted the files (or pasted the prompts), paste this into your assistant to confirm it can see them:

Using only the AEOMCP tools get_account_context, list_workspaces, get_onboarding_status and get_client_report, tell me which brand workspaces I can access and whether a client report is ready for any of them. Do not call any other tool.

Click I installed it to record that you have — a self-report, tracked separately from the download itself (a download never implies installation happened). If your assistant runs a real workflow before you ever click that button, the drawer shows Verified: your assistant ran a workflow. instead, which is the more reliable signal of the two.

Which tools your connected assistant can use

Every personal access token carries the read set (org:read, workspace:read, brand:read, prompt:read, answer:read, usage:read, run:read), which admits the same read tools getting-started.md and tools.md describe for any other authenticated caller — get_account_context, list_workspaces, get_onboarding_status, get_client_report, get_collection_status, get_engine_health, list_runs, and the analytical/read catalog in tools.md.

What it can do beyond that depends on your CURRENT membership role, not on anything chosen when you connected — see authentication.md's role table. An organization_owner/organization_admin token also gets content writes and run (run:execute, run:cancel); an agency_analyst token gets content writes but not run; client_admin/client_viewer stay read-only. Those write and run grants apply only where the deployment has MCP_CONNECTION_WRITES_ENABLED=true on the MCP service; where it is off (the default), every token is read-only whatever its role. Management, billing and send tools (member:manage, billing:manage, org:manage, webhook:manage, workspace:archive, report:approve, report:send) and every personOnly tool are never reachable from a personal access token, whatever role created it — a personOnly tool needs a human signed in through OAuth, which a token by itself never is.