Give each client an identity
Choose its workspace, scopes and expiry. Keep credentials in the client’s secure configuration.
Read the guideFor developers and their agents
Connect an agent.
Use scoped tools.
Use MCP tools to read Work context, propose Memory records and report session activity. Each request is limited by the credential and the records it can access. Client credentials open with the first product stage; the reference is published now so you can plan the integration.
MCP setup
Plan the client connection.
Use the HTTP MCP endpoint to discover tools and operate within the current credential’s authorized scope.
Discover the actual tools
Initialize, inspect tools/list, and use the exact input schema for the work you intend to do.
Read the guideRecord the session
Create a session, link its work and evidence, and handle decisions and retries explicitly.
Read the guideStart with a read
Verify access before taking action.
A client’s effective scopes come from the server. Requests retain explicit tool names and correlation IDs; writes add stable idempotency keys.
Open verify_access referenceSynthetic example · JSON
{
"jsonrpc": "2.0",
"id": "example_verify",
"method": "tools/call",
"params": {
"name": "verify_access",
"arguments": {}
}
}Connection scope
Know what the connection covers.
Private records stay scoped
Membership, credentials and record grants are separate checks. Switching the public entry site cannot expand a client’s authority.
Read the access modelMCP does not capture every command
An MCP connection handles requests sent to that endpoint. Commands executed elsewhere in a client are outside that connection. Security adapters have separate coverage.
Understand coverageStart with the connection guide.
Plan how you will create a client credential, initialize the connection and verify its effective scopes. Access also depends on which services are enabled for the account.
Read the connection guide