Everything you need to get started.

Third Brain ships a small CLI, third-brain-mcp, that wires the tools your team already uses into the brain - Claude Desktop, Claude Code, Cursor, or anything that speaks MCP over stdio. No config files to hand-edit.

npx third-brain-mcp connectnpx third-brain-mcp install claude    # also: cursor, claude-codenpx third-brain-mcp status

connect runs a device flow: it prints a one-time code (for example KTPB-3947), opens <app>/activate in your browser, and waits. An org admin approves the code from the dashboard, a scoped API key is minted once, and the CLI saves it to ~/.third-brain/config.json. In CI, pass --api-key tb_live_... instead of the browser step, or set the THIRD_BRAIN_URL and THIRD_BRAIN_API_KEY environment variables.

install registers the bridge with a client, preserving any existing entries:

• install claudeWrites the Claude Desktop config.
• install cursorWrites the Cursor config.
• install claude-codePrints the claude mcp add one-liner to paste.

Under the hood each client is pointed at npx third-brain-mcp serve, the stdio-to-HTTP bridge that relays MCP traffic to your server - you rarely run it by hand. Run npx third-brain-mcp status any time to sanity-check the saved connection.

Third Brain never marks up tokens - you bring your own provider keys. Add a Connector on the dashboard to configure a provider for your organization. Credentials are encrypted at rest and never returned.

• openaiOpenAI - completions and embeddings.
• azure_openaiAzure OpenAI deployments.
• anthropicAnthropic Claude - completions only.
• googleGoogle Gemini - completions and embeddings (gemini-embedding-001).
• ollamaLocal models via Ollama.
• customAny other OpenAI-compatible endpoint via a base URL.

When a call does not name a provider, one is chosen by key priority. Completions try openai, then anthropic, then google; embeddings try openai, then google - Anthropic is completions-only and has no embeddings API.

Once a client is connected, your agents get five MCP tools. Two read the brain and two write to it - which is how the documentation writes itself.

• search_knowledgePermission-aware semantic search; returns citations.
• get_documentFetch a document you are allowed to view.
• list_collectionsList the knowledge bases you can see.
• add_knowledgeWrite a new document into a collection (needs an ingest or write scope).
• update_knowledgeUpdate an existing document's content.

As an agent works, it calls add_knowledge or update_knowledge to capture a decision, an answer, or a note into the right collection. Ask your assistant to "write up the decision we just made into Engineering / Decisions" and it lands in the brain for the next teammate to find.

Every write is governed. An agent can only write where its key is allowed - editor on the collection, plus an ingest or write scope - and every write passes through the same secret and PII scanners as a manual upload. An add_knowledge that trips the secret scanner is parked as quarantined for human review and tells the model why; an update_knowledge that trips it is rejected outright, so a leaked credential never reaches the index.

You can see exactly what your agents captured on the dashboard: the Overview has a Written by agents card, and the Documents page has an Agent-written filter. Quarantined writes wait there for a human to review and approve or discard.

The same permission-aware brain is reachable through three interfaces your tools already speak. All of them authenticate with a Third Brain API key (they start with tb_), minted by an admin on the dashboard or through the device flow above, and carrying scopes: search, read, write, ingest, manage.

OpenAI-compatible

Point any OpenAI SDK at <api>/v1 and use the model id third-brain. Answers are grounded in your knowledge base and filtered to what your key can see, with citations.

from openai import OpenAI client = OpenAI(base_url="https://api.third-brain.ai/v1", api_key="tb_live_...")resp = client.chat.completions.create(    model="third-brain",    messages=[{"role": "user", "content": "What is our on-call escalation policy?"}],)print(resp.choices[0].message.content)  # grounded in your brain, within your ACLs

Native REST

The native API under /api/v1 gives you full CRUD plus /search and /search/chat.

export TB=https://api.third-brain.aiexport TB_KEY=tb_live_... curl -X POST "$TB/api/v1/search/chat" \  -H "Authorization: Bearer $TB_KEY" -H 'Content-Type: application/json' \  -d '{"query": "Summarize our PTO policy for a new hire."}'

MCP endpoint

The MCP server is a single JSON-RPC 2.0 surface at POST /mcp using the streamable-HTTP format. A client that speaks MCP over HTTP can point straight at it, authenticating with Authorization: Bearer or X-API-Key:

{  "mcpServers": {    "third-brain": {      "url": "https://api.third-brain.ai/mcp",      "headers": { "Authorization": "Bearer tb_live_..." }    }  }}

Access control is the trust pillar under everything the agents write. Third Brain models it as org, team, and user roles - owner, admin, editor, viewer - plus per-collection and per-document grants for users and teams.

Permissions are enforced at retrieval time, pushed into the SQL WHERE clause. A chunk the caller cannot see never enters a search result, an LLM prompt, or a citation - not even indirectly. The same gate governs what agents write back.

Content that looks like it holds credentials is quarantined for human review on the Documents page instead of being indexed. Content classified as PII or confidential is tagged with a sensitivity label and, when it is visible org-wide, listed on the admin-only Oversharing page; a deployment can opt to quarantine it instead. Every query is scoped to a single organization, API keys are least-privilege and rate-limited, and every search, ingest, agent write-back, and admin action is recorded in an immutable audit log with actor, IP, and timestamp.