fx

Connect fx to the Kernel MCP server

OAuth currently fails for fx, interactively or otherwise, with:

MCP authentication for 'kernel' was rejected: expected issuer "https://mcp.onkernel.com" but
the authorization response returned issuer "https://clerk.onkernel.com". fx stopped before token
exchange.

Until it’s resolved, connect with an API key instead of OAuth.

Install with the Kernel CLI

Run the following command:

kernel mcp install --target fx

Configure manually

Alternatively, add Kernel to the mcp map in ~/.fx/mcp.json:

{
  "mcp": {
    "kernel": {
      "type": "http",
      "url": "https://mcp.onkernel.com/mcp",
      "oauth": {}
    }
  }
}

Connect

Start fx, or reload the configuration in an existing session:

/mcp reload

Then authenticate with Kernel:

/mcp auth kernel --open

Authorize access in the browser window that opens. You can then run /mcp list to verify that Kernel is connected.

This is also the path that would otherwise be needed for headless or scripted use — /mcp auth needs a browser, so fx ask, fx acp, and CI can’t complete it even once the OAuth issuer bug above is fixed. Use the API-key workaround below for those regardless.

Connect with an API key (workaround)

Get a project-scoped Kernel API key from the Kernel Dashboard, export it, and reference it from ~/.fx/mcp.json with bearer_token_env instead of oauth:

{
  "mcp": {
    "kernel": {
      "type": "http",
      "url": "https://mcp.onkernel.com/mcp",
      "bearer_token_env": "KERNEL_API_KEY"
    }
  }
}

export KERNEL_API_KEY='<project-scoped-key>'
fx

This works for both interactive and headless/scripted sessions (fx ask, fx acp, CI). kernel mcp install --target fx always writes the OAuth config, so switch to bearer_token_env by hand.

fx rejects a literal Authorization header in a static headers field (the format other MCP clients use for API-key auth) to keep credentials out of the profile file. bearer_token_env is the fx-specific equivalent — it points at an environment variable instead of embedding the token.