# Connect stdio-only clients to Zorlya with mcp-remote

> Use the mcp-remote bridge to reach Zorlya from a client that can only launch local stdio servers, and learn where it keeps its OAuth tokens.

Source: https://zorlya.com/guides/ai-clients/stdio-clients-with-mcp-remote

Updated 2026-10-25.

To reach Zorlya from a client that can only start local programs, run `mcp-remote` with the address `https://mcp.zorlya.com`. The bridge handles the sign in and keeps the tokens. `mcp-remote` is not on Zorlya's list of AI apps, so registration may be refused. We have not tried it.

Its README says most clients are stdio-only and that those with HTTP support often lack the OAuth flows. We do not list which clients that covers, because each client's own documentation is the source for that. Check yours first. If it can add a remote HTTP server with OAuth, use that instead.

**Not on Zorlya's list yet.** Zorlya accepts only the AI apps on its list: Claude, ChatGPT, Claude Code and Cursor ([how it works](/guides/ai-clients/what-you-approve-when-you-connect)). mcp-remote is not on it, so Zorlya refuses its registration unless mcp-remote sends you back to an address that a listed app uses. The README does not give the callback address, so we cannot say whether it matches an address in the list. We have not tried it. The steps below are what mcp-remote's own documentation describes for a remote server.

## What you need

- An approved Zorlya account. A job seeker account needs the Pro plan, because AI client access is part of Pro.
- Node 18 or higher. The README notes that Claude Desktop uses your system Node, even if a newer one is installed elsewhere.
- A browser on the same machine.

## Redirect address

`mcp-remote` builds its callback from a host (default `localhost`), a port and the path `/oauth/callback`. The port is derived from the server URL, a stable value between 3335 and 49150, and it tries up to 8 further ports if that one is busy. This is http on `localhost`, which Zorlya accepts. If you change `--host` to something else, Zorlya accepts only `localhost`, `127.0.0.1` or an https address.

## Steps

1. In your client's MCP configuration, add a server that runs `npx`. The README's example for clients using the `mcpServers` format is:

   ```json
   {
     "mcpServers": {
       "remote-example": {
         "command": "npx",
         "args": [
           "mcp-remote",
           "https://remote.mcp.server/sse"
         ]
       }
     }
   }
   ```

   With Zorlya's address filled in:

   ```json
   {
     "mcpServers": {
       "zorlya": {
         "command": "npx",
         "args": [
           "mcp-remote",
           "https://mcp.zorlya.com"
         ]
       }
     }
   }
   ```

2. Restart the client. `mcp-remote` opens your browser to Zorlya's Connect page.
3. Choose the account and the permission level, then sign in. Read only is the default.

You can test the bridge outside any client with `npx mcp-remote https://mcp.zorlya.com`.

## Where the tokens are kept

Credentials live in `~/.mcp-auth`, or in the directory named by `MCP_REMOTE_CONFIG_DIR`, under a folder called `mcp-remote-v1`. Each combination of server URL, resource, headers and `--authorize-param` values has its own session. Anyone who can read that folder can use your Zorlya connection until the tokens expire (1 hour for access, 30 days for refresh), so keep it private.

To sign out, delete the stored state and restart the client:

```bash
rm -rf ~/.mcp-auth
```

For logs, add `--debug`. They go to `~/.mcp-auth/{server_hash}_debug.log`.

## What you should see

After you approve, the client lists the `zorlya` server and its tools.

## Try it

- "Call Zorlya's top_matches and give me my 5 best matches."
- "Use search_jobs on Zorlya for contract roles in design and summarise the first 3."

## If it does not connect

1. **Node too old or not found.** The client may run a different Node than your terminal. Use 18 or higher.
2. **Stale sign-in.** Delete `~/.mcp-auth` and restart the client.
3. **Transport.** The default `--transport` is `http-first`. Zorlya accepts only POST, so if the bridge falls back to SSE it will fail. Set `--transport http-only` by adding it to `args`.

## What we checked

The steps come from the mcp-remote README, read on 2026-10-17. We did not try the connection to Zorlya through it. The README does not give a literal redirect URI, so the form above is our reading of its description.

See also [security](/security).

## Sources

- https://github.com/geelen/mcp-remote