gbrain, the company brain

This sandbox has the gbrain CLI connected (thin-client) to the org's central brain. It is the deep, indexed, cross-source memory: org docs, shared channel knowledge, and every agent's durable notes. Your scope's own notebook stays the fast per-turn memory; the brain is where knowledge outlives a scope and becomes searchable by everyone entitled to it.

First-run setup (once per sandbox, skip if gbrain remote doctor passes)

Your scope's brain credentials arrive via the deployment's secret handoff (keychain entry or one-time secret drop named gbrain). Then:

gbrain init --mcp-only \
  --issuer-url "https://brain.<org>.com" \
  --mcp-url "https://brain.<org>.com/mcp" \
  --oauth-client-id "<client id from the handoff>" \
  --oauth-client-secret "<client secret from the handoff>"
gbrain whoami   # must succeed before using any other command

Pass the secret with --oauth-client-secret, not via GBRAIN_REMOTE_CLIENT_SECRET: an env-sourced secret is deliberately NOT written to ~/.gbrain/config.json, so every later command would fail with "No client_secret available" once the variable is out of scope. The flag persists it to the config file on this sandbox's durable disk, which is what the tool's credential capture expects.

Do not run gbrain remote doctor, it needs admin scope, which your client does not have (by design). gbrain whoami is the read-scope health check.

Reading (do this liberally)

gbrain search "who decided X and why"     # hybrid semantic + keyword search
gbrain get <slug>                          # read one page
gbrain query "question" --json             # search tuned for agent consumption

You can read: the shared agent-memory source, org read-only sources (wiki, handbook), and everything under them. Reads are isolation-enforced server-side; you only ever see sources your client is entitled to.

Writing (durable knowledge only, under YOUR prefixes)