Antigravity: connect to DevGrail (MCP + login)

sh1 included script

Sets up Antigravity so it can manage DevGrail resources allowed by the supplied API key. Registers the `devgrail` MCP server using the container's `DEVGRAIL_MCP_URL` via `agy mcp add`. It includes **Antigravity: sign in without a browser (credentials)** to install the Antigravity login. The run form asks for the DevGrail API key and the Antigravity OAuth credentials — pasted, or a secret backed by `/home/dev/.gemini/antigravity-cli/antigravity-oauth-token` in a workspace that is already signed in, which stays current on its own. An existing registration is left untouched unless **Replace existing registration** is `yes`. **Security:** the API key is stored in cleartext in `~/.gemini/config/mcp_config.json` as an Authorization header. Prefer a narrowly scoped key. After it runs: start `agy` and ask it to list your DevGrail containers.

What it asks for

DevGrail API keyrequired: The key Antigravity will send to the DevGrail MCP server. Its grants decide what the agent can see and do — create a scoped key rather than reusing an admin one.
MCP URL (override): Leave empty on current workspace images — the URL comes from the container's DEVGRAIL_MCP_URL. Older images don't set it; then enter it here, e.g. https://your-devgrail-host/mcp
Replace existing registration: Choose 'yes' to remove an existing 'devgrail' entry and re-add it — needed after rotating the API key or changing the URL. With 'no' an existing entry is left untouched.

What it runs

The whole script, exactly as it will execute in your workspace. Nothing is hidden — read it before you run it.

#!/usr/bin/env sh
set -eu

log() { printf '[devgrail-mcp] %s\n' "$*"; }
die() { printf '[devgrail-mcp] ERROR: %s\n' "$*" >&2; exit 1; }

PATH="$HOME/.local/bin:${HOME:-/home/dev}/.local/bin:$PATH"
export PATH

MCP_NAME="devgrail"
API_KEY="${DEVGRAIL_API_KEY:-}"
# Workspace images export DEVGRAIL_MCP_URL; the param lets older images override.
MCP_URL="${DEVGRAIL_MCP_URL_OVERRIDE:-${DEVGRAIL_MCP_URL:-}}"
REPLACE="${REPLACE_EXISTING:-no}"
MCP_CONFIG="${HOME:-/home/dev}/.gemini/config/mcp_config.json"

command -v agy >/dev/null 2>&1 || command -v antigravity >/dev/null 2>&1 \
    || die "the 'agy' CLI is not on PATH — run this in a workspace that has Antigravity installed"
[ -n "$API_KEY" ] || die "no DevGrail API key was supplied"
[ -n "$MCP_URL" ] || die "DEVGRAIL_MCP_URL is not set in this container (older workspace images do not provide it) — fill in the 'MCP URL (override)' parameter, e.g. https://your-devgrail-host/mcp"

server_exists() {
    agy mcp list 2>/dev/null | awk 'NR>1 {print $1}' | grep -Fxq "$MCP_NAME" \
        || { [ -f "$MCP_CONFIG" ] && command -v jq >/dev/null 2>&1 \
             && jq -e --arg n "$MCP_NAME" '.mcpServers[$n] // empty' "$MCP_CONFIG" >/dev/null 2>&1; }
}

if server_exists; then
    if [ "$REPLACE" = "yes" ]; then
        agy mcp remove "$MCP_NAME" </dev/null >/dev/null 2>&1 || true
        log "removed the existing '$MCP_NAME' entry so it can be re-added"
    else
        log "MCP server '$MCP_NAME' is already registered — nothing to do."
        log "To point it at a new key or URL, re-run with 'Replace existing registration' = yes."
        exit 0
    fi
fi

# This script body is piped to `sh -s` on stdin, so stdin IS the remaining
# script: keep the CLI from reading it.
agy mcp add --header "Authorization: Bearer $API_KEY" "$MCP_NAME" "$MCP_URL" </dev/null \
    || die "agy mcp add failed"

server_exists \
    || die "'$MCP_NAME' was added but cannot be read back — check $MCP_CONFIG"

log "registered MCP server '$MCP_NAME' -> $MCP_URL"
log "Next: run 'agy' and ask it to list your DevGrail containers."

Included scripts

These come along automatically when you add this script.

Antigravity: sign in without a browser (credentials)

#!/usr/bin/env sh
set -eu
umask 077   # anything this script creates is owner-only by default

log()  { printf '[antigravity-setup] %s\n' "$*"; }
warn() { printf '[antigravity-setup] WARNING: %s\n' "$*" >&2; }
die()  { printf '[antigravity-setup] ERROR: %s\n' "$*" >&2; exit 1; }

PATH="$HOME/.local/bin:${HOME:-/home/dev}/.local/bin:$PATH"
export PATH

TOKEN_JSON="${ANTIGRAVITY_OAUTH_TOKEN_JSON:-}"
OVERWRITE="${OVERWRITE_EXISTING_CREDENTIALS:-yes}"
TOKEN_FILE="${ANTIGRAVITY_TOKEN_PATH:-${HOME:-/home/dev}/.gemini/antigravity-cli/antigravity-oauth-token}"
AGY_DIR="$(dirname "$TOKEN_FILE")"

[ -n "$TOKEN_JSON" ] || die "no Antigravity OAuth token JSON was supplied"
command -v agy >/dev/null 2>&1 || command -v antigravity >/dev/null 2>&1 \
    || die "the 'agy' CLI is not on PATH — run this in a workspace that has Antigravity installed"

if [ "$(id -u)" -eq 0 ]; then SUDO=""
elif command -v sudo >/dev/null 2>&1; then SUDO="sudo -n"
else SUDO=""
fi

# jq is optional: it validates the pasted token JSON.
# Never fail merely because jq cannot be installed; the token file write still proceeds.
# Note: this script body is piped to `sh -s` on stdin, so stdin IS the remaining
# script. Every installer gets </dev/null or a prompt would eat the script.
if ! command -v jq >/dev/null 2>&1; then
    log "jq not found; attempting install (optional)"
    export DEBIAN_FRONTEND=noninteractive
    if   command -v apt-get >/dev/null 2>&1; then $SUDO apt-get update -qq </dev/null && $SUDO apt-get install -y -qq jq </dev/null || true
    elif command -v dnf     >/dev/null 2>&1; then $SUDO dnf install -y jq </dev/null || true
    elif command -v yum     >/dev/null 2>&1; then $SUDO yum install -y jq </dev/null || true
    elif command -v apk     >/dev/null 2>&1; then $SUDO apk add --no-cache jq </dev/null || true
    elif command -v pacman  >/dev/null 2>&1; then $SUDO pacman -Sy --noconfirm jq </dev/null || true
    elif command -v zypper  >/dev/null 2>&1; then $SUDO zypper install -y jq </dev/null || true
    elif command -v brew    >/dev/null 2>&1; then brew install jq </dev/null || true
    fi
    command -v jq >/dev/null 2>&1 || warn "continuing without jq"
fi

mkdir -p "$AGY_DIR"

if command -v jq >/dev/null 2>&1; then
    printf '%s' "$TOKEN_JSON" | jq empty >/dev/null 2>&1 \
        || die "the supplied value is not valid JSON — paste the whole antigravity-oauth-token contents, from '{' to '}'"
fi

if [ -f "$TOKEN_FILE" ] && [ "$OVERWRITE" != "yes" ]; then
    log "$TOKEN_FILE already exists and overwrite is off — leaving it alone"
else
    if [ -f "$TOKEN_FILE" ]; then
        cp -p "$TOKEN_FILE" "$TOKEN_FILE.bak"
        log "backed up previous token file to $TOKEN_FILE.bak"
    fi
    # printf, not a heredoc: the value must land verbatim, with no shell expansion.
    printf '%s\n' "$TOKEN_JSON" > "$TOKEN_FILE"
    chmod 600 "$TOKEN_FILE"
    log "wrote $TOKEN_FILE (mode 600)"
fi

log "done. Run 'agy' — it should start without asking you to log in."

How to get it

Open your DevGrail workspace, go to Scripts → Official scripts, and choose Download. It is copied into your own library, where you can edit it, run it, or set it as a workspace default — the copy is yours, and later changes here do not touch it.