External MCP pairing

Settings, Integrations mints a pairing so a client outside Solenta (Claude Desktop, Claude Code, or any MCP client on this machine) can launch and track tasks through the loopback coder-threads server. Solenta has to stay running. The raw token is shown once at mint; disk stores only a sha256 hash, mode 0600.

Each pairing has a name, an optional expiry (7, 30, 90 days, or none), and an optional project scope. Default capabilities are read and launch. You can also grant steer or read all tasks. New work starts in a managed git worktree and, by default, waits for you to approve it in the app. Revoke a pairing any time. Do not put the token on a command line.

Hosted agents (ChatGPT, claude.ai) cannot reach loopback. If Tailscale is installed and logged in, Expose /mcp on the public internet under Public URL (Tailscale Funnel) publishes the MCP endpoint over HTTPS on port 8443, and Copy public URL gives you the address. It is off by default. A caller on that URL must sign in with OAuth or present a pairing token; the in-app session token is not accepted there.