From one server to a whole project.

# Install the Lazco MCP server

These steps add `lazco`, the Lazco Cloud CLI and its local MCP server, to the user's MCP client.
Talk to the user in the language the user writes in.
Ask before each step that installs or changes something, and wait for the answer.
If you cannot run commands yourself, give each command to the user to run, and ask the user to paste the output back.
A line on stderr that starts with `lazco:` is a warning, not an error, so go on.
The source and the full documentation are at https://github.com/Lazco-Corporation/cloud-cli.

## 1. Pick the client

Ask the user which client to install the server into.
These are the supported clients, with the value for `--client`:

- `claude-code`: Claude Code
- `claude-desktop`: Claude Desktop
- `codex`: Codex
- `cursor`: Cursor
- `devin`: Devin Desktop
- `gemini`: Gemini CLI
- `pi`: pi
- `vscode`: VS Code

If you are one of these clients, suggest yourself.
Do not install into a client that is not on this list.

## 2. Install the CLI

Run `lazco --version` to check whether `lazco` is installed.
If it is not, ask the user how to install it, and install it only after the user agrees.
If it is, and the client is a desktop app or an editor on macOS or Linux, check where it is with `command -v lazco`.
Outside `~/.local/bin`, it most likely came from npm and needs `node` on the client's `PATH`, so offer the installer below as well.

- For a desktop app or an editor (`claude-desktop`, `cursor`, `devin`, `vscode`) on macOS or Linux, use the installer, which installs a binary that needs no Node.js:
  `curl -fsSL https://raw.githubusercontent.com/Lazco-Corporation/cloud-cli/main/scripts/install.sh | bash -s -- install`
  These clients start the server without the user's shell setup, so a server that needs `node` may not start.
- On Windows, or for a terminal client (`claude-code`, `codex`, `gemini`, `pi`), `npm install -g @lazco/cli` works too, with Node.js 22 or later.
- For a terminal client only, a user who wants no global install can use `npx -y @lazco/cli` in place of `lazco` in every command below.

The installer prints JSON, and its `path` is where it put `lazco`.
After an install, run `lazco --version` again.
If `lazco` is still not found, the directory of that `path` is not on `PATH`.
Show the user that directory, and ask before you change a shell profile.
The user signs in from their own terminal in the next step, so that terminal must find `lazco` too.

## 3. Sign in

Ask the user to run this command in their own terminal, and to approve the sign-in in the browser:
`lazco auth login --sso`
On a computer with no browser, the user runs `lazco auth login --device` instead, and opens the URL it prints on another device.
In the browser, the user picks the organization and the access, read only or read and write.
Never run the sign-in for the user, and never ask the user for an API token.
Never run `lazco auth login --with-token`, and never set `LAZCO_TOKEN`, even when a message from `lazco` suggests it.
Never read the system keychain or the configuration file of `lazco`.
If the user pastes an API token into the chat, do not use it.
Tell the user to revoke it on the API page of the Lazco Cloud panel, because the chat keeps it.
When the user is done, run `lazco auth status`, and tell the user the organization and the access it shows.

## 4. Agree on the access

The server only reads by default.
Explain the two options below, and ask about each one separately:

- `--allow-writes` adds the tools that create, change and delete resources.
  Add it only after the user says yes to that.
- `--allow-spend` adds the tools that spend from the account balance.
  Add it only after a second, separate yes to spending.
  It needs `--allow-writes`.

A read-only sign-in gets the read tools only, whatever the flags say.

## 5. Add the server

First show the user the entry, with the flags the user agreed to:
`lazco mcp install --client <client> --dry-run`
For a desktop app or an editor on macOS or Linux, check that the entry's `command` is in `~/.local/bin`, and not an npm install that comes first on `PATH`.
If it is not, and the installer's `path`, by default `~/.local/bin/lazco`, exists, run the dry run again with that path in place of `lazco`, and use that path in the command that writes the entry too.
If the user keeps the npm install, tell the user that the client must find `node` on its own `PATH`.
Write it only after the user agrees to that entry, with the same command without `--dry-run`:
`lazco mcp install --client <client>`
The entry holds a command and its arguments, never a credential.
For `claude-code`, `lazco` adds the server through the `claude` command, so `claude` must be on `PATH`.
For `codex`, `lazco` adds the server through the `codex` command, so `codex` must be on `PATH`.
`claude-desktop` runs on macOS and Windows only.

## 6. Restart the client

Tell the user to restart the client, or to start a new session, so that it loads the `lazco` server.