Connect Claude Code or Codex (MCP)
A coding agent such as Claude Code or Codex can use Orbit Lumen’s MCP server. It then reads your Orbit, Pulse, Forge and Folio data while it works in your code. This page is for developers who want that. It is also for administrators who need to know what it can reach.
MCP is the Model Context Protocol, a standard way for an agent to call tools. The Lumen server offers read tools only.
What a coding agent can reach In development
Section titled “What a coding agent can reach ”| Allowed | Not allowed |
|---|---|
| Read tools for Orbit, Pulse, Forge and Folio | Any change: no create, comment or transition |
| Only the projects you chose when you made the token | Projects you did not choose, even if you are a member |
| What you can see as a project viewer | Administrator tools and the administrator role |
Everything works as for your own questions in Lumen: the agent reads through each product as you, with your permissions. See How Lumen answers and what it can see. A tool that would change data answers “Unknown tool”.
How you will connect In development
Section titled “How you will connect ”-
Open the Agents tab in the Lumen panel and find Coding agents. The section appears only when the MCP server is switched on.
-
Choose the Orbit projects the agent may read. You can choose only projects you are a member of.
-
Create the token. It is valid for 30 days and shown once, with a copy button. Orbit stores only a hash of it.
-
Follow the setup the panel shows for Claude Code or Codex. It reads the token from an environment variable named
ORBIT_LUMEN_TOKEN, so the token itself is never typed into a command. -
When you are done, revoke the token in the list of your active tokens.
Never paste a token into a chat, a work item, a page or a repository.
How the connection works In development
Section titled “How the connection works ”The agent talks to your company address over HTTPS with Streamable HTTP and JSON-RPC, and sends the token as a bearer token:
Authorization: Bearer olr_...The endpoint is https://acme.orbit.inortix.com/api/v1/lumen/mcp. The server supports MCP protocol versions up to 2025-11-25.
Lumen exchanges the token for a read-only Orbit session that lasts ten minutes. On every request, each product then checks three things. The token is not revoked or expired. Agent access is switched on. You are still a member of the project.
- Revoke a token and access stops at once.
- Administrators can switch agent access off, which stops every agent session at once.
- A token is created only from a signed-in browser session, and it works for the projects you chose, nothing more.
What is tested so far
Section titled “What is tested so far”The server has been tested with the official MCP client library against a simulated Orbit. A token reads only the projects of its grant, and a tool that would create a work item is refused. The token does not appear in logs. A check on a live deployment is still ahead.