# Explicit connection examples

For runnable authenticated clients with installation binding, durable approval-bound execution, native n8n/Dify/Langflow adapters and OpenCode/Claude templates, start with the [managed MCP package](managed-mcp/README.md). It defaults to read-only and supports explicit prepare → separate review → resume. The older standalone examples below retain their narrower documented scope.

These are local source artifacts, not marketplace publications. Configuration validation and backend protocol acceptance are separate from a complete native client authentication run. Do not infer interception of unrelated tools.

## OpenCode

Merge `opencode.json` into a project's OpenCode configuration. Provide the actual MCP endpoint and a pre-registered public client ID using `PRAESIDIA_MCP_URL` and `PRAESIDIA_MCP_CLIENT_ID`. No token or client secret belongs in the file. The operator must register the exact callback URI used by the installed client and allow the MCP resource and requested scope. Use `opencode mcp auth praesidia` and `opencode mcp list` to inspect authentication and discovery. The template asks before Praesidia tools; it does not block unrelated native tools.

Primary contract: https://opencode.ai/docs/mcp-servers/ (read 2026-09-06). Client authentication and transport require version-specific acceptance with the actual deployment.

Validation: the public OpenCode JSON Schema accepted this template on 2026-09-06. This checks configuration structure, not a completed OAuth exchange.

## Claude Code

Merge `claude-code.mcp.json` into the project's `.mcp.json`. Set the public endpoint and pre-registered public client ID in the two environment variables above. The example pins callback port 33117; register the exact URI emitted by your installed version. Current documentation uses `http://localhost:33117/callback`; it notes a `127.0.0.1` regression in 2.1.229. Do not use a mismatched registered URI. Run `/mcp` to approve the project connection and authenticate. Keep normal tool confirmations enabled. Do not put a bearer token in headers or a client secret in this project file.

Primary contract: https://code.claude.com/docs/en/mcp (read 2026-09-06). This is a management MCP connection, not general interception or a published plugin.

Validation: Claude Code 2.1.202 accepted the HTTP/OAuth configuration through `mcp add-json` and produced matching project configuration in an isolated directory. No user credentials or live MCP authentication were used.

## n8n

Import `n8n-protected-http.workflow.json` into a disposable workflow. It uses manual trigger 1, Edit Fields 3.4, Code 2, If 2.2, and HTTP Request 4.2 node formats. It remains inactive and has no webhook or schedule. Replace the credential reference on all four HTTP nodes with an n8n Header Auth credential for `Authorization: Bearer <personal caller credential>`. Keep the value in n8n's credential store. The credential needs a real user, `agents:invoke`, `workflows.execute`, and the organization's `proof.actions` feature. The target must be registered by the deployment operator. Free registration alone does not supply those privileges.

1. Edit public fields in **Request settings**: API origin, organization, registered target ID, harmless body, and a unique stable workflow run ID. Leave `"phase": "prepare"` and `"resumeConfirmed": false`.
2. Run manually. **Prepare and stop for review** returns the action ID, approval ID, and request commitment. This branch ends without dispatch. Retain the exact target, body, and checkpoint alongside that response. A separate authorized human reviews the approval in Praesidia.
3. After review, copy the original approval ID and original request commitment into **Request settings**. Keep the target/body/checkpoint unchanged. Select `"phase": "resume"` and `"resumeConfirmed": true` explicitly, then run manually again.
4. The workflow reads the owned checkpoint. Pending, denied, expired, already consumed, or missing-approver states do not reach resume. A mismatched ID/commitment raises an error. The backend independently checks the original requester, tenant, exact request binding, live authority, and approval atomically before dispatch; this client check is not the security boundary.
5. Review **Read committed outcome** and the action's actual evidence. If resume has a timeout or transport error, stop and read the existing checkpoint before considering another attempt. Never change a request under an existing approval or automatically retry a possibly dispatched effect.

The checkpoint runtime is `custom`; this example is an explicit HTTP workflow and makes no native n8n agent-tool interception claim. It does not depend on n8n's MCP transport. The current MCP Client Tool documentation labels its endpoint SSE, so Streamable HTTP compatibility must be separately tested.

Public request/response contracts are the Praesidia Protected HTTP Execution API, and node definitions are pinned for validation to `n8n-nodes-base@2.15.1` with `n8n-workflow@2.15.0`. Imported execution/authentication against your n8n deployment remains a separate acceptance step.

## Dify

Create a custom API tool from `dify-protected-http.openapi.json` in a disposable Dify workspace. The schema exposes exactly two operations: `preparePraesidiaHttpRequest` and `readPraesidiaHttpCheckpoint`. It does not expose approval, resume, revocation, arbitrary target URLs, or native tool interception. The API origin is fixed to `https://api.praesidia.ai`; an operator using another deployment must edit that origin before import.

Configure API Key authentication in Dify's credential store with header `Authorization`, Bearer prefix, and the personal caller credential as the value. Do not select query-string authentication or paste the credential into this schema or a workflow prompt. The same real-user, `agents:invoke`, `workflows.execute`, and `proof.actions` requirements described for n8n apply.

The current Dify importer exposes object body parameters as text fields. Supply valid JSON strings in the `body` and `checkpoint` fields; the request serializer converts them to JSON objects. For a harmless preparation, set:

```json
{
  "orgId": "REPLACE_WITH_ORGANIZATION_UUID",
  "targetId": "REPLACE_WITH_REGISTERED_TARGET_ID",
  "body": "{\"message\":\"harmless evaluation\"}",
  "checkpoint": "{\"runtime\":\"custom\",\"threadId\":\"REPLACE_WITH_STABLE_RUN_ID\",\"nodeId\":\"dify-checkpoint\"}",
  "description": "Dify request for separate human review"
}
```

Retain the returned `approvalId`, `actionId`, and `requestCommitment`. Use the read tool with that organization and approval ID to inspect fresh state. Preparation creates a pending request; neither an approved response nor a read dispatches it. A separate caller following the protected HTTP guide must resume the exact approved request. If any request fails or returns an unknown outcome, inspect the existing checkpoint and do not assume success.

Validation on 2026-09-06: OpenAPI 3.0.3 validation passed. The actual Dify parser and Pydantic parameter models at commit `dde1d500b5bcbf8a05b37b3615ebaff6219b84b4` were executed in an offline, isolated fixture: two operation IDs, required fields, and exact JSON-object serialization passed. This is not a Dify server import, credential-store, transport, or authentication acceptance run. The generic Dify HTTP client follows redirects; this schema does not override that behavior. Validate the actual deployment's origin, redirect behavior, access, and credential handling before use.

Primary contracts: [Dify API tool parser](https://github.com/langgenius/dify/blob/dde1d500b5bcbf8a05b37b3615ebaff6219b84b4/api/core/tools/utils/parser.py) and [request serializer and authentication](https://github.com/langgenius/dify/blob/dde1d500b5bcbf8a05b37b3615ebaff6219b84b4/api/core/tools/custom_tool/tool.py), read 2026-09-06. No marketplace submission is claimed.

## Langflow

Paste `langflow-praesidia-checkpoint.py` into a new custom component in a disposable Langflow flow. It uses the actual `lfx==1.12.0` component API and a `SecretStrInput`. Store the caller credential through that secret input; keep it out of exported flows and prompts. The origin is an operator-controlled class constant, fixed to `https://api.praesidia.ai`; it is not an agent input. The same caller permissions and registered-target requirements above apply.

For `prepare`, provide the organization UUID, registered target ID, exact JSON object through the request-body input, and a unique stable workflow run ID. The output contains the pending checkpoint. Retain it and the original request for separate review. For `checkpoint`, provide the organization UUID and returned approval UUID. Each output resolution reads fresh state. The component never approves or resumes requests, follows redirects, or retries a failed request automatically. It preserves an unknown outcome as unknown.

This custom component is used because Langflow's generic OpenAPI Agent is a broader HTTP tool; importing a schema there alone does not establish this component's fixed-origin and secret-input behavior. This is an explicit workflow step, not a host-wide enforcement hook or a marketplace publication.

Validation on 2026-09-06: Python 3.12 with `lfx==1.12.0` evaluated the source and built its real input/output template. Seven tests use the actual component output resolver and HTTPX's local mock transport: exact preparation, fresh checkpoint reads, input rejection before network access, denial/redirect handling, no retry on timeout, unknown/malformed outcomes, and the secret-input template. No real Langflow deployment, account, or API request was used.

To reproduce from this source directory in a disposable environment:

```sh
python3.12 -m venv .example-venv
.example-venv/bin/python -m pip install 'lfx==1.12.0'
.example-venv/bin/python test_langflow_checkpoint.py -v
```

Primary contracts: [Langflow component source](https://github.com/langflow-ai/langflow/blob/e3abffc1b8da1e38cc2f21a9cf1b23b4a21c15d5/src/lfx/src/lfx/components/data_source/api_request.py) and [generic OpenAPI Agent](https://github.com/langflow-ai/langflow/blob/e3abffc1b8da1e38cc2f21a9cf1b23b4a21c15d5/src/lfx/src/lfx/components/langchain_utilities/openapi.py), read 2026-09-06.