Skip to content
by Shift Engineering

Build with your agent

For citizen developers

You don’t write code or commands. You describe what you want, and your coding agent builds it through Greenlight. This page covers the two things that happen first: making sure your agent is connected, and asking for the right thing.

Your agent is probably already connected

Section titled “Your agent is probably already connected”

Your coding agent reaches Greenlight through a plugin. In most organizations IT turns this on for everyone, so the plugin is already there — and already pointed at your Greenlight install — the moment you open your agent. Greenlight ships this plugin for Claude Code, Codex, Cursor, and Copilot. The portable core of that package conforms to Agent Plugins 1.0 (Agent Skills and Streamable HTTP MCP), so a client that implements that standard can install the same package. Agents that do not support the packaged plugin still connect with the Greenlight MCP URL (see Other agents).

When IT rolls the plugin out, they also apply an organization policy so Greenlight actions run without a separate approval click. Greenlight still enforces your identity, role, policy checks, and audit trail on every governed action.

To check, ask your agent to do something with Greenlight — “list my Greenlight apps,” say. If it can, you’re set. The first time it touches Greenlight it asks you to sign in through your organization’s identity provider; sign in once and you’re done.

If it isn’t there yet

Section titled “If it isn’t there yet”

The best first step is to ask IT to roll it out to your team — enabling it for everyone is their call and the smoothest path for everyone after you.

If you’d rather add it yourself in the meantime, open the dashboard’s Agent setup page (/settings/agent-setup) — the Install the plugin button on an empty Apps page goes there too — and choose your agent. If your organization has more than one marketplace repository, choose one of those as well. If the page says your admin hasn’t set up the Greenlight plugin yet, there is nothing to install: it names your org admins, so ask one of them. The commands below clone the repository from GitHub, so pick a public source, or a private one only if you have Git access to it; IT’s organization rollout needs neither, because the vendor serves its own copy. Agent setup says which visibility your chosen agent needs, and warns when the repository you picked can’t serve the self-serve steps. (On claude.ai, Claude Desktop and Cowork there’s nothing to add: Greenlight appears once IT has synced it under Organization settings → Plugins & skills.) The Greenlight URL is already baked in, so you don’t paste it anywhere.

IT normally rolls Greenlight out to everyone, so check first: type /greenlight in Claude Code. If it resolves, the plugin is already installed and you’re done — the steps below are only for when it isn’t.

  1. Open the plugin marketplace and choose Add marketplace.
  2. Enter the repository selected on Agent setup.
  3. Install the Greenlight plugin, then sign in through your identity provider on first use.

Command-line equivalent, in the Claude Code CLI — run them one at a time:

Terminal window
/plugin marketplace add <selected-org>/<selected-repo>
Terminal window
/plugin install greenlight@greenlight-tools

Then turn on auto-update for greenlight-tools under /plugin → Marketplaces; it is off by default for a marketplace you add. A copy you install yourself outranks your organization’s plugin, so uninstall it once IT rolls Greenlight out.

On claude.ai, Claude Desktop and Cowork — and in Claude Code when you sign in with your claude.ai account — Greenlight arrives from your organization’s Plugins & skills, which a Claude organization Owner sets up; there is no self-serve plugin install on those surfaces. You can still reach Greenlight without the plugin by adding your org’s MCP URL (shown on Agent setup) as a connector under Settings → Connectors, signing in when prompted, and choosing Allow on the Greenlight page that names the connector’s address, on any plan that lets you add your own connectors — on Team and Enterprise an Owner enables it for the organization first. For the plugin itself, ask IT for the organization plugin rollout.

If your organization runs Greenlight on its private network, Claude.ai, Claude Desktop connectors, and cloud agents cannot reach it. Use Claude Code in the terminal or the Desktop Code tab, from the company network; Agent setup lists the clients that work.

Other agents

Section titled “Other agents”

For any agent Greenlight doesn’t ship a packaged plugin for, connect it to the Greenlight MCP server directly. The Agent setup page gives you three copyable values:

  1. Your MCP URL — https://greenlight.<your-org>/mcp — paste it into the agent’s MCP-server settings as a Streamable HTTP MCP server.
  2. The Greenlight skill file — a single instructions file you can drop into agents that read free-form rule/skill files.
  3. The CLI installer — the /cli/install.sh URL on the same Greenlight host, for agents that need the standalone CLI fallback.

Either way, the first tool call prompts the same identity-provider sign-in.

Describe what you want

Section titled “Describe what you want”

The best prompts have three things: what the app does, who uses it, and what data it touches. With those three, the agent has enough to register the app, ask Greenlight for the right integrations, and start building.

Build me a small tool for the finance team to track reimbursements. People should be able to submit a request, a manager approves or rejects, and finance exports approved ones to a CSV. SSO only, just for internal employees.

I need a dashboard for the data team that pulls weekly sales numbers from Snowflake and shows the top 20 accounts. Read-only, and only the people in the data-team group should see it.

Make a Slackbot that listens to messages in #it-tickets and creates a row in our HubSpot CRM for each one, tagging the assigned person.

The more specific you are about who and what data, the less back-and-forth the agent needs.

Don’t have a fully-formed idea? That’s fine too. Ask the agent what you could build, and it starts by looking at what’s available in your organization — which data sources apps can use, what your colleagues have already built — then suggests ideas and asks a few quick questions (who will use it, whether it needs to remember data, which company systems it should pull from) to shape yours. The Apps page in the dashboard also lists those available integrations (names and logos), so you can name them when you ask.

If you name a system your organization hasn’t connected, the agent tells you so and names what is connected instead of guessing or quietly building against nothing. Connecting a new one is your IT administrator’s call, and the agent can’t file that request for you — ask them directly. If nothing is connected yet, the agent says that too, and can still build an app that stores its own data.

What the agent does next

Section titled “What the agent does next”

A few things happen between your prompt and a running app. You’ll see most of them in the agent’s chat.

  1. Registers the app. A new repository appears in your organization’s source control, and the app shows up in the Greenlight dashboard.
  2. Reads context. The agent pulls Knowledge from your organization — design system, conventions, integration playbooks — so the app matches how your org works.
  3. Shows you the app as it takes shape. The agent runs a live preview while it builds and puts it in front of you — you watch screens appear, click around, and react. “Make the table sortable,” “that blue is wrong,” “move the button” — changes here take seconds, so this is where most of the shaping happens. The agent doesn’t publish a change you haven’t seen working.
  4. Declares the integrations it needs. If the app needs Snowflake or Slack or anything else, the agent declares it in the app’s greenlight.yml. When the pull request merges, Greenlight activates the grant automatically if your org’s policy allows it, or queues it for IT to approve — you’ll see a “waiting on IT” status until they do. (That merge-time activation is the app’s access path; for local work with no app at all, your agent can request access for you instead — see Local development.)
  5. Opens a pull request. The agent writes the code and opens a pull request. Greenlight’s policy check runs automatically.
  6. Deploys on merge. Once the policy check passes and the pull request merges, the app deploys. The agent verifies it works, then shows you the live app.

You don’t need to step in for any of the technical pieces. If something fails, the agent reads the failure and tries again. If it needs your input — clarification, an approval, IT to grant something — it’ll ask.

If your organization has turned on Agent reports, the Claude Code plugin also watches for Greenlight errors your agent works around. After each turn it may send just those Greenlight calls and their results, with ids and secrets removed, to a small Claude model through your own Claude sign-in. If the model judges it a platform problem, the plugin files one short report to your organization’s Feedback page. Nothing else from the conversation leaves your machine, and nothing appears in your chat.

If your organization has turned on Build token usage, the Claude Code plugin also adds up how many tokens each session used when it ends, reading the session’s own record on your machine, and sends those counts per model to your install for the app whose folder you were working in. Only the counts leave your machine: never your prompts, the conversation, or file paths, and no model is involved. A session outside an app’s folder sends nothing.

Your app knows who’s signed in

Section titled “Your app knows who’s signed in”

You’ll never set up logins. Everyone reaches your app through your organization’s single sign-on, the same way they reach everything else — so by the time someone opens your app, Greenlight already knows who they are and has confirmed they’re allowed in.

Your app gets that knowledge for free, which means your agent can build features that are personal to each user without any of the usual account plumbing:

  • Per-person settings and data — “save my filters,” “show my drafts,” “remember what I picked last time.”
  • Showing who’s here — “Signed in as priya@acme.com,” a personalized greeting, or attributing each action to whoever did it.
  • A tailored view — surfacing the right starting screen for the person looking at it.

Just ask in plain terms — “remember each person’s settings,” “show who submitted each request” — and the agent wires it up. Who is allowed to use the app at all is a separate, IT-controlled setting (see Getting help from IT); this is about making the app feel personal once they’re in.

When the agent asks you something

Section titled “When the agent asks you something”

Most of the time, the agent figures things out on its own. The exceptions are usually one of:

  • A design decision — “should this app be public to the whole company or restricted to the finance team?”
  • A naming choice — “what should we call this app?”
  • A scope question — “do you want to add email notifications too, or keep it Slack-only for now?”
  • An access request — “this app needs Snowflake access, which IT will have to approve. OK to request it?”
  • An approval click in your coding agent. IT’s policy covers the usual Greenlight calls. The agent can still ask you to allow:
    • a command that starts with node
    • a Greenlight call Cursor does not already recognize
    • a download of the Greenlight command-line program from your Greenlight site

Answer in plain language. The agent translates your answer into the right configuration.

Next

Section titled “Next”
Local developmentHow the agent builds and runs your app against real, governed data — with no credential on the laptop.
Your appThe statuses your app moves through, and the Knowledge that makes the agent smarter over time.
Getting help from ITWhen the agent needs IT to step in.