The console is where you create agents, enter secrets and answer approvals. It has four screens, listed in its sidebar: Agents, Pending actions, Connections and Settings. Signing in lands you on Agents, because an agent is what you come for.

​
Sign in

On Graft Cloud, open https://app.getgraft.ai and choose Create an account: a name, an email and a password of at least eight characters. The account opens a session at once and owns your connections and your toolbox, however many agents you run. On self-hosted Graft, open the URL your deployment answers on (http://localhost:3000 by default) and sign in as the admin the first start created from GRAFT_ADMIN_EMAIL and GRAFT_ADMIN_PASSWORD. The sign-up form is there too, for a second account. If you opened a handoff link an agent relayed while signed out, signing in returns you to that action.

​
Create an agent

1

Agents → New agent

The dialog asks for four things.
  • Name. Where the harness runs, and which one it is: laptop Hermes, ops OpenClaw.
  • Working-set cap. How many authored tools may be promoted for this agent at once. Default 20.
  • Idle window (days). A tool unused this long is demoted from the working set. Default 21.
  • Scope. The connections this agent may use. Its tools cannot reach a connection outside the scope. Empty is fine on a new account; an agent proposes the connections it needs and each one lands in its scope when you connect it.
Choose Create agent.
2

Copy the token

The next view says This token is shown once. Graft keeps only its hash, so copy it now; if it is lost, revoke this agent and create another.Under the token, the dialog shows the MCP server URL and a Harness choice, Hermes first, with two blocks in that harness’s shape. For Hermes they are the line for ~/.hermes/.env and the YAML entry for ~/.hermes/config.yaml:
Pick OpenClaw for the Gateway’s mcp.servers block and its ~/.openclaw/.env line, or Any MCP client for the generic mcpServers block with an export line. The URL is your deployment’s origin plus /mcp. The configuration block carries no secret and can live in a config file you commit. Choose I have copied the token when you have.
3

Paste the block into your harness

The two harness pages carry the same blocks with the hosted URL, and what to reload once they are in place:

Hermes

OpenClaw

​
The agent’s page

Open an agent from the Agents table to see how to connect it, what it may reach, and what is in its list.
  • Connect a harness, in the header, reopens the setup with a placeholder where the token was; the header shows the token’s prefix so you can tell two agents apart. The token itself is not here.
  • Scope is the set of connections the agent may use. Tick and untick, then Save scope; it is in effect on the agent’s next call.
  • Name, cap and idle window are the agent’s own settings, also reachable as Edit from the agents list. Saved values take effect at the next sweep.
  • Working set is the agent’s MCP tool list beside the meta-tools: each tool, whether it asks (read-only, write or destructive), who promoted it, and when it was last used.
  • Approvals lists your standing answers for this agent, per tool, with Withdraw on each.
  • History is every promotion and demotion with its cause, newest first.
  • Revoke token stops the harness at the MCP endpoint at once. The agent’s working set and history stay as your records; to reconnect the harness, create a new agent.

​
Where next

Quickstart

Ask for something no tool covers and watch the first one land.

Agents and persons

Why the toolbox is yours and the working set is the agent’s.