Connect your agent

This gateway serves the Sekreto anti-detect browser automation MCP server. Pick your client below, paste the block, done. Your account number checks usage at any time; the secret API key lives only in your client's config.

Limits

Every plan's defaults. Your key's exact numbers are always available via the usage tool.

Requests per month	2,000
Concurrent requests	3
Requests per minute	60

Onboarding recipes

All three use the same endpoint: https://api.sekreto.ai/mcp

Claude (Desktop & Code)

No key handling on your side — sign in with your API key in the browser when prompted. Discovery (RFC 9728) is live, so Claude does the rest.

Claude Code:
  claude mcp add --transport http sekreto https://api.sekreto.ai/mcp

Claude Desktop:
  Settings → Connectors → Add custom connector
  URL: https://api.sekreto.ai/mcp

On first connect a consent page opens: approve, paste your wv_live_… API key in the form, and the session tokens are refreshed automatically from then on.

Goose

OAuth support is broken upstream (block/goose issues #5107, #5669, #3545) — use a raw-key header until then, and re-test when rmcp 0.8.5 ships. The header value is the raw key: no Bearer prefix.

# ~/.config/goose/config.yaml
extensions:
  sekreto:
    name: sekreto
    type: streamable_http
    url: https://api.sekreto.ai/mcp
    headers:
      x-api-key: wv_live_YOUR_KEY_HERE
    enabled: true
    timeout: 300

Hermes / Centipede

Two environment variables; the Centipede web plugin discovers and registers everything else.

export SEKRETO_URL="https://api.sekreto.ai"
export SEKRETO_API_KEY="wv_live_YOUR_KEY_HERE"

Using stock Hermes mcp_servers instead? Point it at the same URL and let the gateway session binding handle the rest:

# ~/.hermes/config.yaml
mcp_servers:
  sekreto:
    url: https://api.sekreto.ai/mcp
    headers:
      x-api-key: wv_live_YOUR_KEY_HERE

401 troubleshooting

Nearly every 401 is one of these three:

1. The header name is exactly x-api-key — all lowercase, no spaces, no X-Api-Key vs x-api-key ambiguity concerns in HTTP/2 (send it lowercase).
2. The value is the raw key. The most common mistake: adding a Bearer prefix. x-api-key: Bearer wv_live_… is always a 401 — the literal word "Bearer" plus the space becomes part of the key. Only the Authorization header takes Bearer <key>.
3. Key is the full string starting wv_live_, copied whole (32 hex chars after the prefix). No trailing whitespace, no quotes in header values.

Revoked key → also 401 with "API key has been revoked." Rotated your key? Update every client still holding the old one.

Usage

Two ways to check what you've used — both free, neither consumes quota:

# any MCP client, one tool call:
{"tool": "usage"}

# or plain REST with your key:
curl -H "x-api-key: wv_live_YOUR_KEY_HERE" https://api.sekreto.ai/usage

Returns requests used this month, your monthly limit, concurrent sessions in flight, and your rate limit. The account dashboard (account number, top-ups, invoices) lives at sekreto.ai/account.html.