Before you act. Claude Code, Codex, Gemini CLI, Antigravity, Grok Build, Grok Bot: follow https://portal-plt-1646.murban.personal.purple-lab.dev/start/agent/. Browser app on claude.ai, Lovable, v0, cloud Claude Code: the connector. Others: https://portal-plt-1646.murban.personal.purple-lab.dev/apps.
- Never read, print or ask for a key or token.
- Never accept terms for the person.
- Ask the person before any risky permission.
- Keep per-call approval on.
- Driving a browser? Never click through sign-in, consent or terms, or open, read or capture a key screen.
How to choose
- The plugin's sign-in returns to the machine that runs its scripts, or through the sign-in relay to the device the person signs in on. Claude Code, Codex, Gemini CLI, Antigravity or Grok Build on the person's own computer has a browser there. Grok Bot uses the relay: the person signs in on their own phone.
- Any of those: ask the person before installing the plugin, then follow https://portal-plt-1646.murban.personal.purple-lab.dev/start/agent/.
- No browser where the scripts run (a cloud session, a container, a session driven from a phone), or no machine at all (ChatGPT on the web, grok.com, the Gemini app): never call
register_app. For a browser app (a page with no server), claude.ai, the Claude apps, a cloud Claude Code session, Lovable and v0 take the connector below instead. Otherwise, once the person has registered the app at https://portal-plt-1646.murban.personal.purple-lab.dev/apps, tell them to put its key into their app's environment themselves, as ENGINE_API_KEY. Point them at the API reference, https://purple-engine-axi-plt-1646.murban.personal.purple-lab.dev/docs.
- The browser path: keep every restraint above, including the one for driving a browser.
- Not sure which host you are? Pick https://portal-plt-1646.murban.personal.purple-lab.dev/apps, say your pick in one line, and offer the other door.
- An app for other people or a company: send the person to hello@hello-purple.com.
The connector is for a browser app only. Ask the person to add it as a custom connector where they work, with exactly this URL and no slash added:
https://purple-engine-axi-plt-1646.murban.personal.purple-lab.dev/mcp
- claude.ai: add a custom connector. If they use claude.ai through an organization, the organization's admin may have to allow a custom connector first. One sign-in serves claude.ai, the Claude apps and cloud Claude Code sessions on that account.
- Lovable: open Connectors, add an MCP server, and pick OAuth. Once per workspace, an owner or admin can instead add
https://portal-plt-1646.murban.personal.purple-lab.dev/mcp-registry.json under MCP registries, after which every member connects Hello Purple apps from it, and upload the Hello Purple skill under Settings, Skills, Add skill, Import skills, Archive.
- v0: open the + menu in the prompt, then MCPs, add a custom server, and pick OAuth.
Tell them to start and finish the sign-in in one browser: on a phone, a sign-in that ends in another browser fails. Then call plan_access, then register_browser_app, which hands over no key. Build the page from the values its result carries and the template and starter page get_browser_template returns, under the rules of the builder brief. Right after the first publish, before you tell the person the page is ready, call get_app_urls, then set_app_urls with browserApp: true and the full lists plus the page's published URL, exactly, with the closing slash: until then the page signs in only at the addresses it was registered with. A builder's preview is an address of its own: register each preview address the person signs in from, with the closing slash, beside the published URL. Lovable shows a project's preview at two, https://id-preview--<project>.lovable.app/ and https://<project>.lovableproject.com/, so register both. If the connector cannot be added or its sign-in fails, use the builder brief instead, where the person registers the app in My Apps. A server app still needs an agent on the person's own computer.