# How an agent connects to Korium Korium is Kyroco's company memory for AI assistants. An assistant reaches it through one remote MCP server and signs in with OAuth on behalf of a person. This page says what that takes today, in four steps. A person always signs in. Korium has no way for an agent to create an account or get access on its own, and its sign-in metadata carries no agent registration block. ## 1. The person needs a Korium account Create one at . The plans and their prices are at , as markdown read from the live plan catalog. There is no free trial: a paid plan is paid by card when the person signs up for it. ## 2. Add the MCP server - Address: - Transport: Streamable HTTP The client registers itself automatically. The authorization server supports dynamic client registration (RFC 7591) at , so no one has to create a client ID by hand. A client that already has a registration can keep using it. ## 3. The person signs in and approves access 1. The client calls the MCP server without a token. The server answers 401, and its `WWW-Authenticate` header points at the protected resource metadata. 2. The client reads that metadata, then the authorization server metadata it names. 3. The client opens the browser with an authorization code request. PKCE with `S256` is required. 4. The person signs in to their Korium account, the same sign-in they use at . 5. If the client will receive the sign-in on a remote server rather than on the person's own computer, Korium asks the person to allow that client the first time. A client on the person's own computer gets no extra question. 6. The client exchanges the code for an access token and a refresh token, then calls the MCP server with the access token. Send the access token in the `Authorization` header as a bearer token. Korium also accepts tokens bound to a key with DPoP (RFC 9449), signed with `ES256`. ## 4. Ask for the scopes the work needs | Scope | What it allows | | --- | --- | | `engram.read` | The tools that search and read, including memory search, browsing, reading a long memory back, code search, counts and the starter toolkit. | | `engram.write` | The tools that save and change, including saving a memory, linking memories, correcting a link, importing memories and submitting a code index. | | `offline_access` | Says the client means to keep a refresh token. Korium returns one with every sign-in either way. | Ask for `engram.read` alone to search only. Ask for `engram.read` and `engram.write` to save memories as well. Each tool needs its own scope, so `engram.write` without `engram.read` cannot search. The server lists only the tools the granted scopes allow. The scope names start with `engram.`. Do not rename them. The authorization server metadata also lists `openid` and `product.register`; an MCP client needs neither. ## Where to read the details - Protected resource metadata, the source of truth for the scopes: - Authorization server metadata, with every sign-in endpoint: - The connection guide, with each client's setup and troubleshooting: - The MCP server card: