Document the Connect Agent page

src/pages/agent-network/connect-agents.mdx

@@ -0,0 +1,94 @@
+import { Note } from '@/components/mdx'
+
+export const description =
+  'Point a local AI tool at NetBird Agent Network from the Connect Agent page: the keyless endpoint, ready-made configuration for Claude Code, Codex, the OpenAI SDK and cURL, and the providers and models your own policies allow.'
+
+# Connect Agents
+
+**Connect Agent** is the self-service page each user configures their own tools from. It
+carries the account's [keyless endpoint](/agent-network/providers#the-keyless-endpoint), a
+ready-made configuration snippet for common agent tools, and the providers and models the
+user's own policies allow.
+
+Unlike the rest of Agent Network, the page needs no administrative permission. Every
+authenticated account member sees it, and the answer behind it is computed from the caller's
+own group memberships, so two users on the same account can see different providers.
+
+<p>
+    <img src="/docs-static/img/agent-network/connect-agent/agent-network-connect-agent.png" alt="Connect Agent page with the API base URL, the Claude Code configuration snippet, and the caller's providers and models" className="imagewrapper-big" />
+</p>
+
+## API Base URL
+
+The endpoint is the account's Agent Network base URL, shared by every connected provider
+and reachable only over the NetBird overlay.
+
+Agents send ordinary LLM requests to it with no provider API key. NetBird
+authenticates the caller through your identity provider, authorizes the request against
+your [policies](/agent-network/policies), and injects the upstream provider key
+server-side.
+
+## Configure Your Tool
+
+Pick the tab that matches your tool. Each snippet is pre-filled with your endpoint, so it
+can be copied and applied as it is:
+
+- **Claude Code** — writes `ANTHROPIC_BASE_URL` into `~/.claude/settings.json`, together
+  with an `apiKeyHelper` that satisfies the client's key check without a real key. Use the
+  **Shell** link above the snippet to switch to the equivalent `export` lines, and **JSON**
+  to switch back.
+- **Codex** — a provider block for `~/.codex/config.toml`.
+- **OpenAI SDK** — a Python client pointed at the endpoint's `/v1` path, with a placeholder
+  `api_key` the client requires but NetBird ignores.
+- **cURL** — a complete request, handy for a first smoke test.
+
+The dropdown above the Claude Code snippet selects which backend the configuration targets:
+**Anthropic API**, **Vertex AI**, or **Bedrock**. Claude Code reaches Vertex AI and Bedrock
+through their own base URL variables, so the snippet changes accordingly.
+
+<Note>
+A **Kimi CLI** tab and a **Kimi (Moonshot AI)** entry in the Claude Code dropdown appear
+only when a Kimi provider is reachable for you, since that configuration works only against
+an endpoint that can route to it. See the
+[Kimi integration guide](/agent-network/integrations/kimi) for the provider side.
+</Note>
+
+## Your Providers & Models
+
+The table lists what the caller's policies authorize, not everything the account has
+connected. Each row names the provider as the administrator labelled it, with the catalog
+provider underneath, and the models it may be called with:
+
+- **All Models** — no [guardrail](/agent-network/policies/guardrails) model allowlist
+  restricts this provider for you.
+- One or two model names, or a count such as **3 Models** past that — the effective
+  allowlist. Hover the count to read the full list.
+
+<p>
+    <img src="/docs-static/img/agent-network/connect-agent/agent-network-connect-agent-providers-models.png" alt="Your Providers & Models table listing a Bedrock provider limited to three models and an OpenAI provider with all models allowed" className="imagewrapper" />
+</p>
+
+A provider the account has connected but no policy of yours references does not appear
+here, and a request to it is refused at the endpoint the same way.
+
+## No Providers Available Yet
+
+Agent Network denies every request by default, so a user no policy covers yet sees the
+endpoint and the snippets but an empty provider list.
+
+<p>
+    <img src="/docs-static/img/agent-network/connect-agent/agent-network-connect-agent-no-providers.png" alt="Connect Agent page with an empty provider list explaining that no access policy covers the user yet" className="imagewrapper" />
+</p>
+
+The empty state states the fix in the terms of whoever is reading it:
+
+- Users who can edit policies are pointed straight at **Policies**, where adding one of
+  their groups to a policy grants them access.
+- Everyone else is asked to have an administrator add them to an Agent Network access
+  policy.
+
+This is also what an account with no providers connected at all looks like from a member's
+side: with nothing connected there is nothing for a policy to authorize. An administrator
+starts by [connecting a provider](/agent-network/providers#connect-a-provider), then
+[creating a policy](/agent-network/policies) that covers the group the user belongs to. The
+page fills in as soon as both exist, no change is needed on the agent.