# Connect an AI to Ente

Use these instructions when a user asks you to connect to Ente. Ente is a private knowledge graph for reusable company and personal context.

## Safety rules

- Never ask the user to paste an Ente password, email verification token, API key, OAuth code, claim token, or access token into chat.
- Open only Ente-owned pages for the user's sign-in, claim, consent, onboarding review, and connection management. Machine-to-machine endpoints may use infrastructure domains only when the current Ente product authentication document explicitly advertises the exact URL.
- Request only the scopes needed for the user's task.
- Do not create a second credential until you have checked for an existing Ente connection.

## Choose the connection path

### Remote MCP-capable client

1. Fetch the current Ente authentication document at https://app.ente.fast/auth.md. Treat this Ente-owned document as the trust anchor.
2. Confirm that it explicitly names https://graceful-narwhal-769.eu-west-1.convex.site/.well-known/oauth-protected-resource before fetching that machine metadata. Use the MCP `resource` URL the metadata advertises. The currently advertised managed resource is `https://graceful-narwhal-769.eu-west-1.convex.site/api/mcp`.
3. Do not assume `https://app.ente.fast/api/mcp`: it is not the resource currently advertised by Ente's metadata.
4. Follow the advertised authorization flow. Infrastructure URLs are for the agent's protocol requests only. Open every human step on its returned Ente-owned URL.

The product authentication document and protected-resource metadata are authoritative if an endpoint changes.

### Local shell or coding agent

Prefer remote MCP for ordinary access. If the user explicitly asks for the CLI, honor that request even if MCP already works. This is Ente’s private knowledge-graph / relationship-manager CLI, not Ente Photos.

Follow https://ente.fast/cli.md for new installation, upgrades, PATH conflicts, authentication repair, and legacy configuration. Install or upgrade with:

```sh
npm i -g ente-cli --registry https://gitea.i.ivo-zilkenat.de/api/packages/ivo.zilkenat/npm
```

Open https://app.ente.fast/setup and select Ente CLI for account authorization. Reuse valid credentials. Never put secrets in chat, repositories, project .env files, or logs.

## Route by user state

### Fully new user

If the current product authentication document explicitly supports the human-claimed `service_auth` flow, initiate it as documented:

1. Ask only for the email address the user wants to use for Ente.
2. Request the minimum scopes needed.
3. Show the returned verification URL and user code.
4. Let the user complete the Ente-owned claim and onboarding review pages.
5. Poll only as directed by the flow and respect its interval.

If `service_auth` is not advertised, open https://app.ente.fast/setup and let the user complete setup there.

### Existing Ente user without AI setup

Open https://app.ente.fast/setup. Let the user sign in and approve the connection there. Do not collect credentials in chat.

### Existing API-key or CLI setup

Do not create duplicate credentials. First inspect the client's configured Ente connection and verify it with a safe read-only operation. For local CLI repair or migration, follow https://ente.fast/cli.md. Open https://app.ente.fast/setup for connection management.

## Verify the connection

After authorization:

1. Initialize the MCP session and request the tool list.
2. Confirm that Ente tools are present and that the granted scopes match the user's request.
3. Run one safe read-only Ente operation, such as a search, when the granted scopes allow it.
4. Report that the connection works. If onboarding review is still required, open the returned Ente page and wait for the user to approve it before attempting writes.

Human overview: https://ente.fast/connect/
Product setup: https://app.ente.fast/setup
Privacy: https://ente.fast/privacy/
Terms: https://ente.fast/terms/