External AI Agent Setup
Connect Claude Cowork, Codex, or your own AI agent to Laserreach
Create a revocable org token, paste one setup block into your agent, and let the agent use Laserreach APIs while keeping hosted run control off by default.
Recommended setup
Leave Laserreach-hosted run control off for most local agents. The agent can use its own memory and model provider, then call Laserreach APIs for account context, workspace files, policies, schedules, recommendations, content, ads, browser sessions, and intel.
Leave hosted-ai:use off when the local model supplies signal reasoning and outreach copy. The MCP helper saves local copy with use_ai=false.
Install the public Laserreach AI skill for portable operating instructions. It contains no token or account-specific values.
Choose Self-governed local agent when the local agent should send and publish without per-action approval. Organization caps, sender checks, business hours, deduplication, kill switches, scopes, and audit logs remain active.
Connect HubSpot in Laserreach before enabling CRM logging. The outreach sync endpoint writes deduped Company, Contact, Deal, and Note records, then verifies the write before reporting success.
Watch first
60-second setup walkthrough
This video shows the recommended Claude Cowork or Codex setup with placeholder credentials. Use the checklist below when handing setup to a customer, operator, or contractor.
Instructions to send someone else
Send the checklist to anyone setting up Claude Cowork, Codex, or another local agent. The checklist includes the owner steps, the exact prompt block for the agent, the first curl test, and the optional MCP/webhook runner.
Please follow this Laserreach setup guide: https://www.laserreach.com/docs/external-agent-setup Use the recommended local-agent API access mode. Do not enable Laserreach-hosted run control unless we explicitly decide the agent should control hosted Laserreach runs. After the token is created, paste the complete setup block into Claude Cowork, Codex, or your local agent. Ask it to start by calling the capabilities URL and to use only the routes returned by that response.
Sign in and open External Agents
Sign in to Laserreach, open your organization, then go to Settings and External Agents.
If you manage more than one organization, confirm the org shown in the settings page before creating the token.
Create a scoped token
Name the token after the tool you are connecting, such as Claude Cowork or Codex. Keep the default scopes for the normal local-agent setup.
Select Use self-governed setup for direct sends and publishing without human approval. Use custom scopes for governed access. Leave Allow Laserreach-hosted run control off unless you want the agent to start, steer, cancel, retry, or prune Laserreach runs.
Copy the setup block
After creating the token, copy the complete setup instructions. The token is shown once. Store it in the connected tool, not in a shared document.
Authorization: Bearer <external_agent_token> X-Org-ID: <org_id> Capabilities URL: https://api.laserreach.com/api/abm/agent/capabilities Run URL (read/list by default): https://api.laserreach.com/api/abm/agent-runs ICP URL: https://api.laserreach.com/api/abm/icps Signal URL: https://api.laserreach.com/api/abm/signals Token kill switch: DELETE https://api.laserreach.com/api/abm/agent/token HubSpot Outreach Sync URL: https://api.laserreach.com/api/abm/crm/hubspot/outreach-sync Local MCP/webhook helper: https://github.com/tcmartin/laserreach-local-agent-mcp Portable AI skill: https://github.com/tcmartin/laserreach-local-agent-mcp/tree/main/skills/laserreach
Connect HubSpot for CRM logging
Open Integrations, connect HubSpot, and authorize the Laserreach app. The app can now be installed on customer HubSpot accounts from the sample install URL after the HubSpot AUP was accepted.
Use HubSpot Outreach Sync URL for local-agent sends. It performs dedup checks, writes Company/Contact/Deal/Note, associates the records, and returns a verification result.
Paste it into the AI agent
Give the full setup block to Claude Cowork, Codex, or your agent client. Tell it to start by calling the capabilities URL and to use only routes returned by that response.
You are connected to Laserreach through this external-agent token.
Start with:
GET https://api.laserreach.com/api/abm/agent/capabilities
Use the returned capabilities to choose Laserreach APIs.
Do not start, steer, cancel, retry, or prune Laserreach-hosted runs unless I explicitly ask and this token has agent-runs:control.
Do not call model-backed endpoints unless this token has hosted-ai:use.
Source collection stays raw when hosted-ai:use is off. Assess each signal with your local model and write the result back.
Use your local model to assess signals, then save the result with PATCH /api/abm/signals/{signal_id}/assessment.
Use laserreach_create_local_sequence for local outreach copy. It forces use_ai=false.
Use require_icp_match=true and min_score=0.5 for the actionable signal queue.
Starting a local-copy sequence requires outreach:send but does not require agent-runs:control or hosted-ai:use.
When Approval mode is self_governed, execute allowed sends and publishes without waiting for human approval.
Account caps, sender checks, business hours, deduplication, kill switches, scopes, and audit logging still apply.
Account settings, caps, connector credentials, kill switches, and governance remain user-managed.
Use https://api.laserreach.com/api/abm/crm/hubspot/outreach-sync to log local-agent outreach to HubSpot. Start with dry_run: true before writing CRM records.
Prefer local planning and memory. Use Laserreach for scoped API actions and source-of-truth account context.Test the connection
Ask the connected agent to fetch capabilities and summarize what it can access. A successful connection returns route groups and sensitive-scope requirements.
curl "https://api.laserreach.com/api/abm/agent/capabilities" \ -H "Authorization: Bearer <external_agent_token>" \ -H "X-Org-ID: <org_id>"
Rotate or revoke access when needed
Revoke the token from the External Agents screen, or call DELETE /api/abm/agent/token with that token. Self-revocation can only disable the bearer token making the request.
Optional local automation
Run a local MCP server, webhook receiver, and cron jobs
Use the open-source helper when Claude Desktop, Codex, or another local agent should call Laserreach tools, react to webhooks, or poll on a schedule.
npm install -g github:tcmartin/laserreach-local-agent-mcp # Install the open-source skill for Codex. Use claude, agents, or gemini for another client. npx -y github:tcmartin/laserreach-local-agent-mcp install-skill --target codex export LASERREACH_AGENT_TOKEN="<external_agent_token>" export LASERREACH_ORG_ID="<org_id>" export LASERREACH_API_BASE="https://api.laserreach.com" export LASERREACH_WEBHOOK_SECRET="<shared_webhook_secret>" # Test API access. laserreach-local-agent capabilities # Start an MCP server for Claude Desktop, Codex MCP clients, or other local agents. laserreach-local-agent mcp # Create and run webhook/cron automation config. laserreach-local-agent init laserreach-local-agent serve --config ./laserreach.local-agent.config.json
For Claude Desktop, use npx with args ["-y", "github:tcmartin/laserreach-local-agent-mcp", "mcp"]. The repo includes a complete config example.
Any AI without a skill loader can read the public skill instructions directly.
The helper exposes laserreach_sync_hubspot_outreach for local-agent HubSpot logging. Start with dry_run: true.
# Single-file Codex webhook bridge. export LASERREACH_AGENT_TOKEN="<external_agent_token>" export LASERREACH_ORG_ID="<org_id>" export LASERREACH_WEBHOOK_SECRET="<shared_webhook_secret>" export WEBHOOK_PATH=/laserreach/events # Enable only after reviewing the generated command. export CODEX_AUTO_RUN=1 node ./laserreach-codex-webhook-bridge.mjs
curl -X POST "http://127.0.0.1:8797/webhooks/signal.created" \
-H "Content-Type: application/json" \
-d '{"event_id":"evt_demo","type":"signal.created","account_id":"acct_123"}'Set LASERREACH_WEBHOOK_SECRET before exposing the listener outside your machine. The helper does not grant run control by itself; local agents still follow token scopes and the agent-runs:control boundary.