Coconut Context plugin for Claude Code

A thin wrapper around Coco's MCP door (POST /mcp). Installing the plugin gives Claude Code the same context_* and agent_* tools that the Claude connector gets — nothing else. No skills, no hooks, no agents.

Install

/plugin marketplace add anthropics/claude-plugins-community

/plugin install coco-context@claude-community

At enable time Claude Code prompts for Coco MCP endpoint — the full URL including the /mcp path. It defaults to https://api.coconut.md/mcp. The plugin uses the value verbatim rather than assembling it from an origin, so a stray trailing slash can't produce //mcp (which 404s, and a 404 carries no WWW-Authenticate header, so OAuth never starts).

Use the API origin, not the app origin. The Next app proxies /mcp and both .well-known documents, but the protected-resource metadata it returns names https://api.coconut.md/mcp as the canonical resource, so a client connecting through the app sees a resource identifier that doesn't match the URL it called.

The value is stored per-user under pluginConfigs in ~/.claude/settings.json, so different machines can target different deployments.

Auth

The server advertises OAuth via RFC 9728. On the first tool call Claude Code gets a 401 with a WWW-Authenticate header pointing at /.well-known/oauth-protected-resource/mcp, then runs dynamic client registration (/oauth/register), authorize, and token exchange on its own. You approve in the browser once; Claude Code stores the token.

If it doesn't kick off automatically, run /mcp and authenticate the coco server from there.

Revoke access from /admin/connectors in the Coco UI.

Agent-key (bearer) instead of OAuth

The plugin deliberately ships OAuth-only so there's one code path. For headless or CI use where the browser flow isn't available, skip the plugin and configure the server directly with an agent key from /admin/agent-keys:

claude mcp add --transport http coco https://api.coconut.md/mcp --header "Authorization: Bearer $COCO_AGENT_KEY"

What you get

Tools land under the scoped prefix mcp__plugin_coco-context_coco__.

Context — context_whoami, context_space_list, context_create_space, context_create_shared_page, context_get_shared_page, context_update_shared_page, context_list_shared_pages, context_recent_shared_pages, context_search_shared_pages, context_get_shared_page_revisions, context_get_page_metadata, context_set_page_metadata, context_query_pages_by_metadata, context_list_metadata_keys, context_get_page_links, get_context_by_url, plus the context_*_personal_page* equivalents for personal spaces.

Agents — agent_list, agent_list_tasks, agent_get_task, agent_create_task, agent_update_task, agent_run_task, agent_list_runs, agent_get_run, agent_get_instructions, agent_set_instructions.

ACL outcomes are identical to the REST surface — the plugin adds no privileges of its own.

Local development

Point the endpoint at a local Coco stack with http://localhost:8787/mcp.

To iterate on the plugin itself without going through GitHub, load this directory directly:

claude --plugin-dir /Users/you/Developer/coco-context

Validate before publishing:

claude plugin validate . --strict

Troubleshooting

• 405 on connect — something is issuing GET /mcp. The door is POST-only; check the base URL has no path component beyond the origin.
• Repeated 401 — the stored token expired or was revoked. Re-authenticate from /mcp.
• Tools list is empty — the principal resolved but has no space membership. Grant it in /admin/spaces/:spaceId/members.
• Wrong org's pages — for multi-tenant deployments the org is stamped from the OAuth token, not from a header. Re-authenticate as the right identity.