Set up Corvio MCP in Claude and CoworkSet up Corvio MCP in Claude and Cowork

This is Claude's current product model, not a Corvio compatibility problem. A Connector is Claude's name for the live remote MCP connection. A Plugin is the installable package that can bundle that Connector with Skills and other instructions. Cowork supports both.

If Corvio is visible in Claude's directory, install it there. Until its listing has completed review, use the direct Plugin upload or custom Connector path below.

Download the Corvio Claude Plugin ZIP in your browser, open Claude Customize → Plugins, choose the add or upload action, and upload the ZIP. The package contains the official corvio-operate-workspace Skill, a short SessionStart reminder, and a remote MCP definition for https://api.corvio.ai/mcp; it contains no API key.

When Claude asks to connect the bundled Corvio Connector, continue to the Corvio authorization page. Sign in, review the scopes, approve, return to Claude, and start a fresh Cowork task. For research, report, plan, project, or document work, Claude should silently make one narrow read-only Corvio search after the safety gate. Exact continuation handles are a receipt-backed prior-work handoff even in a fresh process: Claude should load the Skill and read them instead of asking you to reconstruct context; if the relevant leaf is unclear, it should fetch the carried Project, use the returned direct-child projection as a bounded topology index, and then fetch the leaf while preserving any truncation boundary. It should honor a clear current correction to Workspace identity or relationship before asking only about authority that remains unresolved. Keep Claude's normal file workflow. OAuth does not authorize automatic uploads: an explicit current request or a user-owned standing preference must cover the write; otherwise Claude should deliver normally and ask once whether to save the specific result.

Claude should preserve the original file as an Asset first. Copyright, public availability, or third-party authorship alone does not make a user-selected source restricted; preserve provenance and applicable use terms, and exclude it when an explicit restriction forbids the requested private Workspace retention or processing. A supported UTF-8 Markdown Asset can then become an editable Page through source_asset_id. A newly finalized source that should enter a Work Model, reconcile affected owners, or receive Skill evaluation goes directly to one organize_files operation; that Mission owns source preparation. Use ask_corvio only for a bounded answer or artifact that does not require that lifecycle.

Poll the returned operation to terminal and inspect output_document, source_reconciliation, and skills_evaluation; do not submit duplicate ask_corvio Questions while waiting for source readiness. Stable facts/preferences may enter Memory; only a qualifying reusable method becomes a Project Skill. always requires the evaluation, not a synthetic Skill, and evaluated_no_qualifying_skill is valid.

You may install Corvio before you have an account. When Claude first connects, the Corvio authorization page lets you sign in or create an account and then returns to the same permission request. Install Corvio when you want Claude to reuse earlier research, decisions, project material, or selected files and leave useful work where you can inspect and continue it.

Prefer Claude's reviewed directory when Corvio is available there. Until that separate review is complete, use the first-party Plugin ZIP, inspect the public source, and compare the package manifest and hash.

The ZIP contains two reviewed Corvio Skills, the remote MCP definition for https://api.corvio.ai/mcp, this setup guide, and a SessionStart shell hook. It contains no API key.

The hook only prints static Corvio guidance into Claude after startup, resume, clear, or compaction. It does not inspect local files, read environment variables, or make network requests. Remote network calls begin only after you approve OAuth.

Claude should explain the use case, source, package contents, Corvio permissions, and removal path, then ask once if you have not already confirmed. If you explicitly confirm and the source, hash, permissions, and host policy align, Claude should continue instead of repeating the same generic warning.

Lack of independent coverage is a reason to inspect provenance and permissions carefully, not proof by itself that matching official bytes are malicious. Claude must still stop for a source/hash mismatch or an organization policy, and it must hand the UI step to you when the current task cannot perform it.

OAuth lets you sign in or create a Corvio account inside the browser authorization journey. You do not need an invite code or Developer API key. Claude receives only the scopes shown on the consent page and remains limited by your Workspace membership and object permissions. OAuth does not automatically expose your computer, unrelated accounts, or complete Claude history; Corvio receives the tool requests and content Claude sends.

The permission is not risk-free: granted tools can read or change Corvio data. To end access, remove the Connector in Claude and revoke the Remote MCP connection credential in Corvio Settings → API keys.

First identify the installation source. In Claude Code, run claude plugin list. A name ending in @synced is the copy synced from your Claude account; "synced" means newest in that account, not necessarily newest from Corvio. In Cowork, check whether an administrator installed a directory or organization copy, or whether you uploaded corvio-workspace.zip yourself.

On the first Corvio use in a fresh session, the Agent should pass any already-visible loaded version and source facts to get_collaboration_contract with response_mode=freshness_only. Current copies stay quiet; a legacy or unverifiable copy returns one compact, source-aware notice. The Agent should not repeatedly ask you to inspect versions or repeat the notice in the same session.

Remote MCP tools update on Corvio's server and normally only need a fresh task; reconnect OAuth when scopes change. A directory or marketplace Plugin follows that channel's update control. Replace a directly uploaded Plugin ZIP from the same official source; shared or organization-managed copies must be updated by their owner. For a standalone Skill, use the provider- and scope-specific command returned by corvio collaboration status. corvio capabilities reads Corvio API facts without contacting npm; corvio update check is the explicit registry-backed check for the optional CLI.

A reviewed directory or marketplace source is the long-term managed path. Until external listing acceptance, direct ZIP upload is an explicit fallback because Claude provides no Corvio-upstream auto-update channel for a user-uploaded package; that is a host boundary, not a switch this task can enable.

If your Claude surface cannot upload a Plugin, open Customize → Connectors, choose Add custom connector, and enter https://api.corvio.ai/mcp. This gives Claude live Corvio tools. Install the standalone Skill separately only when that surface exposes a Skills upload UI.

On Pro or Max, a user can add a custom Connector. In Team or Enterprise, an Owner or Primary Owner normally adds the Connector for the organization, after which members connect their own Corvio account. This administration rule is owned by Claude, not Corvio.

The ordinary Claude connection uses browser OAuth. Corvio supports its current account sign-in methods on that page. CORVIO_API_KEY is only an advanced Developer API or non-interactive CLI option, and the optional CLI uses corvio auth login for an interactive device link.

Do not ask Claude to create, reveal, or paste an API key. Do not replace a failed OAuth callback with a shared key.

A message such as connect_rejected (organization policy) comes from the isolated Cowork execution environment's network-egress policy. The Corvio download endpoint is public; the refusal occurs before that sandbox reaches it. Browser web search and the Cowork code sandbox can have different network policies.

Use your normal browser to download the canonical ZIP from Corvio, then upload the local file through Claude's Plugin UI. The Corvio URL is the canonical origin; the GitHub Release is a byte-identical immutable fallback generated from the same release manifest. Directory installation is the long-term zero-download path. After installation, verify list_workspaces, search, and fetch; a successful upload alone does not prove OAuth or Workspace access.

ask_corvio returns one durable operation ID. The Agent can call get_question with a bounded wait, then copy progress_cursor into after_cursor to receive only later user-visible milestones. These updates summarize the current phase; they never expose hidden reasoning or count as a final answer.

To stop the work, the Agent calls cancel_question on that same operation. cancellation_requested means Corvio is still stopping it; only cancelled is terminal, and effects that already settled remain recorded. To correct or redirect the work, finish or cancel the current operation, then ask a successor Question with its conversation_id.