macOS, Linux, and Windows
The GraphMem commands use the same client syntax in a macOS/Linux terminal and Windows PowerShell. Keep the endpoint as one argument; do not translate it into a shell variable containing a token.
Loading
Connection guide
GraphMem is a hosted remote MCP service. You will add one endpoint, authenticate in your browser, and keep working in the agent you already use. There is no GraphMem client to download, unless your agent runs on a remote machine; then a small helper lets you sign in with a code.
Step 01
GraphMem configures an existing MCP-compatible client. Install or update your client through its official channel first; GraphMem does not ship an agent installer.
The hosted endpoint is live, but GraphMem is in private preview: only accounts the GraphMem team has enabled can complete sign-in. There is no self-serve sign-up and no public request form or contact channel on this site yet. Without an invitation, browser sign-in stops at the access check.
If the GraphMem team has enabled your account, sign in with that Google account. The same account opens the console at https://console.graphmem.sezer.ai.
Before you run mcp add or mcp login, sign in once at https://auth.sezer.ai/ and complete onboarding: create or join your organization and its project. MCP sign-in needs an existing Sezer account with an active project.
If the browser shows Finish setting up your Sezer account during login, onboarding is incomplete. Follow its Go to onboarding link, finish setup, then run the client login again.
The GraphMem commands use the same client syntax in a macOS/Linux terminal and Windows PowerShell. Keep the endpoint as one argument; do not translate it into a shell variable containing a token.
Claude Code and Codex return from the browser to a loopback address on the machine they run on, so their built-in login fails when the agent runs on a cloud VM or over SSH. Use the sign-in with a code instead. Never paste a bearer token into a tunnel or project file.
Step 02
Choose a client, add the public endpoint https://graphmem.sezer.ai/mcp, and keep the configuration at the scope you intend.
Add the remote MCP server, then complete OAuth in your browser.
codex mcp add graphmem --url https://graphmem.sezer.ai/mcpcodex mcp login graphmemRun in the Codex terminal to inspect configured servers.
codex mcp listAdd GraphMem at user scope, then type /mcp inside Claude Code to authenticate.
claude mcp add --transport http --scope user graphmem https://graphmem.sezer.ai/mcpRun inside Claude Code to inspect and authorize the server.
/mcpWhen your agent runs on another machine than your browser, sign in with a code, the way codex login or claude login works. The small graphmem-connect helper (one Python 3.9+ file, no dependencies) shows a code on the remote machine. You approve it at https://auth.sezer.ai/device from any browser, and the login finishes on its own. Your agent then talks to GraphMem through the helper, which renews access automatically.
This path is rolling out with the next GraphMem release. Until then, the download returns 404 or login reports that the sign-in service does not recognise graphmem-connect yet.
The GraphMem service itself serves the file. Python 3.9 or newer is the only requirement.
mkdir -p ~/.local/bincurl -fsSL https://graphmem.sezer.ai/cli/graphmem-connect.py -o ~/.local/bin/graphmem-connectchmod +x ~/.local/bin/graphmem-connectThe command prints a code. Open https://auth.sezer.ai/device on your laptop or phone, enter the code, and approve. Only approve a code you started yourself. The terminal reports Signed in after a few seconds.
~/.local/bin/graphmem-connect loginRun on the same remote machine. If GraphMem was added earlier with the URL, first run claude mcp remove --scope user graphmem.
claude mcp add --scope user graphmem -- ~/.local/bin/graphmem-connect bridgeRun on the same remote machine. If GraphMem was added earlier with the URL, first run codex mcp remove graphmem.
codex mcp add graphmem -- ~/.local/bin/graphmem-connect bridgeThe refresh token is stored only in ~/.config/graphmem/credentials.json (readable only by you). If access is revoked or expires, run login again.
~/.local/bin/graphmem-connect status~/.local/bin/graphmem-connect logoutThese clients connect with a configuration file instead of a GraphMem command. None has a recorded end-to-end sign-in yet; the status on each card says what is known.
Cursor finishes OAuth through a cursor:// callback, which the auth server accepts. No Cursor sign-in has been recorded end to end yet.
{
"mcpServers": {
"graphmem": {
"url": "https://graphmem.sezer.ai/mcp"
}
}
}Start the server from the MCP view and approve the browser prompt. Loopback callbacks are accepted; a hosted vscode.dev callback is not accepted yet.
{
"servers": {
"graphmem": {
"type": "http",
"url": "https://graphmem.sezer.ai/mcp"
}
}
}Uses the community mcp-remote bridge (Node.js required), which signs in through a local loopback callback. Restart Claude Desktop after editing the file.
{
"mcpServers": {
"graphmem": {
"command": "npx",
"args": [
"-y",
"mcp-remote",
"https://graphmem.sezer.ai/mcp"
]
}
}
}Custom connectors added in claude.ai, Claude Desktop settings, or ChatGPT return to a hosted HTTPS callback on claude.ai or chatgpt.com. The auth server does not accept those callbacks yet, so authorization fails. Use a client above until this changes.
A client that discovers OAuth from the 401 response and uses a loopback or device-grant sign-in should be able to connect. Never paste a bearer token into a config file.
Transport: Streamable HTTP, https://graphmem.sezer.ai/mcp
Resource: https://graphmem.sezer.ai/.well-known/oauth-protected-resource
Auth server: https://auth.sezer.ai (RFC 8414 metadata)
Registration: dynamic client registration or client ID metadata document
Client type: public client, PKCE S256, no client secret
Callback: loopback (127.0.0.1 / localhost) redirect
Headless/SSH: OAuth device authorization grant
Scopes: mcp:connect memory:read memory:writeStep 03
Identity and consent happen in a browser, so the client never needs a GraphMem password or copied bearer token.
The client opens or prints a browser handoff owned by https://auth.sezer.ai. Pass the access check with your invited Google account, review the requested project and capabilities, then approve or cancel. This page never runs the handoff itself.
Cancellation or denial should leave the client in a needs authorization state. Credentials belong to the client/auth broker; never paste cookies, access tokens, or client secrets into these commands.
Step 04
Verification is a sequence of observable client states, not a green badge because a command was copied.
The client lists GraphMem at the intended user/project scope.
The browser consent completed for the intended identity and project, or the client clearly reports that authorization is still needed.
Inspect the client’s MCP menu, then perform only an approved scoped read when the service is actually available. Do not create a sample memory as a connection test.
Wait for the browser callback; do not retry writes.
Cancellation or expiry should request consent again.
A service error is not proof that the graph is empty.