Roll out Claude to your team

Add Arbituro to your Claude organization

On a Team or Enterprise plan, an Owner adds the connector once for everyone.

1. In Claude, open Organization settings, then Connectors.
2. Choose Add, then Custom. If Claude asks for the connector type, choose Web.
3. Enter the server address.

https://app.arbituro.com/mcp

4. Leave the OAuth client ID and secret empty. Arbituro’s sign-in accepts Claude’s published client identity and registers clients automatically, so there is nothing to create first.
5. Choose Add.

Members then connect under Customize, then Connectors, and each signs in with their own Arbituro account. Adding the connector gives nobody access to Arbituro. Each person still needs to belong to the workspace, and reaches only what their roles allow.

Choose an address

https://app.arbituro.com/mcp reaches every workspace a person belongs to. Each call names a project, and the project decides the workspace. Arbituro’s web app already reaches all of a person’s workspaces, so this address gives nobody more than they have.

https://app.arbituro.com/mcp/<workspace key> reaches one workspace. Its key is shown in Arbituro under Settings, then Connections, then Your coding agent. A sign-in for this address is refused at every other.

Choose the narrower address when people belong to workspaces that must stay apart, such as a contractor who works for two clients. With the wider address, text one client wrote could steer what the agent reads or writes in the other client’s workspace.

Decide what agents can reach

An agent connected over MCP has exactly its person’s access. There is no agent account, no API key and nothing to switch on in Arbituro. You govern it with the same memberships and roles that govern people, and in each project the role decides what a person and their agent can do:

Owner and project admin

Do the work, approve, and manage the project’s settings and members.

Editor

Reads and changes work, and starts agent runs. Can’t approve.

Viewer

Reads only. Their agent can read the project, and every write is refused.

• A project’s jobs are visible only to its members, workspace owners and admins included.
• Removing someone from a workspace or a project, or lowering their role, applies on their agent’s next call.
• Agents connected over MCP can’t act through any of the workspace’s connections. The one exception is reading a pull request through the GitHub app, to link it.

See People and roles.

Where agents’ requests go

Agents connected over MCP can’t change a job or decide anything. Their requests wait for a person.

• A proposed change to a job waits for a person to approve or decline it in Arbituro.
• A claim that an acceptance criterion is met goes to the person who decides that criterion, with what the agent checked. If the criterion names nobody, it goes to the person who judges the job.
• A criterion decided by a CI check is settled by the check, on a linked pull request.
• Notes and new jobs are filed under the person’s own name, as if they had written them in Arbituro. A new job is not assigned, and no work starts.

Let agents link pull requests

A coding agent can put the pull request it opened on its job, so the job shows the CI results and any criterion a check decides can be settled. For that, connect GitHub to the workspace and link the repository to the project, which only workspace owners and admins can do. See GitHub.

Linking reads the pull request through the GitHub app and writes nothing to GitHub. An agent can link only pull requests in a repository linked to the job’s project.

Review what agents did

Every MCP call made in your workspace is recorded in its audit log. Each record names the person, the client the call came from, and the project and job it named. The text an agent sends, such as a note’s body, is not copied into the audit record.

• Calls are recorded as mcp.tool. followed by the tool’s name, such as mcp.tool.get_job.
• A linked pull request is also recorded as mcp.pull_request_linked.
• Proposed changes and claims also appear in the job’s own activity record, where the people on it see them.

The client’s name is what the client says it is, so treat it as a label rather than proof of identity. See Activity and audit log.