Connected agents use the same Keep account and library. They can work with the same Notes, Items, tags, collections, Projects, and highlights.
Keep does not create a separate library for each agent. Connected agents are not team members. This feature does not publish Notes or share them with other Keep accounts.
Connect an agent with the CLI
Install and authenticate the Keep CLI first. Then create a named credential for the agent:
| Current client | Run this exact command |
|---|---|
| ChatGPT | keep login chatgpt |
| Claude Code | keep login claude-code |
| Claude Desktop | keep login claude-desktop |
| Codex | keep login codex |
| Cursor | keep login cursor |
| OpenCode | keep login opencode |
| Pi | keep login pi |
Each command shows a short code and opens Keep in your browser. Approve it there, and Keep stores a separate credential for that named client.
When an agent is carrying out setup, it should run the matching command itself. The user only needs to sign in, check the code, and approve access in the browser.
Check the current connections with:
keep auth status
keep auth listKeep detects Codex, Claude Code, and Cursor during login and selects the matching credential automatically. Other integrations pass their client name directly.
Connect an agent over MCP
Use the Keep MCP server when the AI client supports MCP.
- Add the Keep MCP server to the client.
- Start the connection.
- Sign in to Keep in the browser window.
- Approve access to your account.
The MCP client uses the same library as the Keep app and CLI.
What a connected agent can do
A connected agent can read and write:
- Items
- Notes
- tags
- collections
- Projects
- highlights
A connected agent cannot create credentials. It cannot revoke credentials or manage webhooks. Use your personal Keep session or personal API key for those tasks.
Review agent changes
Every Note revision records the trusted client identity. Open a Note and select its revision count to see the history.
The Notes page also has an Agent edits view. This view shows Notes last changed by a connected agent.
The client name comes from its authenticated connection. Text inside a Note cannot change that identity.
Handle changes from two agents
Every Note write includes the revision that the client read. Keep rejects the write if another client has already created a newer revision.
The agent must read the Note again after a conflict. It must review the newer content. It can then retry the change with the current revision number.
This process keeps both changes visible. It prevents one agent from silently overwriting another agent.
An agent update also keeps any metadata it did not name. Removing tags, Project, kind, or state takes an explicit clear value. The write result lists those metadata changes, so the client can show what changed.
Disconnect an agent
Remove a CLI connection with:
keep auth remove codexYou can also disconnect an agent in Settings, under API and agents. Revocation takes effect at once. It does not affect your personal key or other connected agents.
Disconnecting an agent does not remove the Notes or revisions that it created.
Keep agent access separate
Give each agent its own named connection. Do not copy one agent credential to another client.
Treat each credential like a password. Revoke it if it might be exposed. The API key guide explains personal and read-only keys.