API and MCP: how agents drive Uno

What happens when an agent connects

You never paste a key into a chat. The agent asks Uno for a short code, you open the link and press Approve, and the key goes straight into the agent's .env. The code lives 15 minutes.

# 1. ask for a code, then show the person the link it returns
$ curl -s -X POST https://console.uno.place/api/v1/agent/connect \
    -H "Content-Type: application/json" -d '{"client_name":"Claude Code"}'
# 2. after Approve, pick up the key without printing it
$ curl -sf -X POST https://console.uno.place/api/v1/agent/connect/token \
    -H "Content-Type: application/json" \
    -d '{"device_code":"…","wait":60,"format":"dotenv"}' >> .env

The key opens sites, computers, storage and secrets; no billing and no new keys. It lasts 90 days, and you revoke it any time on the Access page of the console.

What happens when it runs a command

The agent calls /run on your computer. If the computer sleeps, the call wakes it first, runs the command and returns the output. A command gets 60 seconds by default and up to 3,600 seconds.

$ curl -s -X POST https://console.uno.place/api/v1/boxes/42/run \
    -H "Authorization: Bearer $UNO_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{"cmd":"cd app && npm test","timeout_s":600}'

# plans and prices, no key needed
GET  /api/v1/box-plans
# create a computer within your plan
POST /api/v1/boxes
# wake it if needed and run one command
POST /api/v1/boxes/{id}/run
# put it to sleep with memory kept, or wake it
POST /api/v1/boxes/{id}/sleep
POST /api/v1/boxes/{id}/wake
# publish a folder as a site, free
POST /api/v1/deploy
# turn daily copies on or off
PUT  /api/v1/boxes/{id}/backup-schedule

The full list, with every field and error: OpenAPI spec. For agents: llms.txt.

In plain terms, everything the web console can do, the API can do. There is no feature you can only click. Paying is the one step that stays with a person.

What happens when you connect ChatGPT or Claude

Add Uno as a custom connector with the address https://console.uno4.dev/api/v1/mcp. You sign in with Uno and tick what the chat may do; there is no key to paste. The two riskiest rights start unticked.

Publishing, deleting, running a command and writing a file are marked as destructive, so the chat app asks you before each one. And agents in Uno Work come with Uno's tools already connected.

What an agent cannot do

Some things stay yours alone: money, passwords and billing are out of reach of an agent key or a connected app. When a task needs a plan, the API answers 402 PLAN_REQUIRED with a checkout link, and the agent hands that link to you.

Where you see what it did

Every command an agent runs on a computer, and every file it reads or writes there, is written to that computer's access log under the name of the key or app that made it. A command from a key you named "ci" reads as Agent token “ci”. A command from ChatGPT reads as Connected app “ChatGPT”. If an agent did something you did not expect, you find out which one, and revoke its key in one click on the Access page.

Key from the console

Agent token “name”

ChatGPT or Claude.ai

Connected app “name”

Agent in Uno Work

Uno Work on this computer

Limits

What it does not do

• No payments by agents. Buying or changing a plan is always your click.
• A synchronous call through the public address is cut after about 90 seconds of silence. For longer commands, ask for the result later with wait_s or stream it.
• One command at a time per computer: a second call gets 409 BOX_BUSY.
• With "run commands" ticked, the chat runs them as root. Tick it only for an app you trust.