MCP (pilot)

Authorization

Understand OAuth scopes, workspace grants, and revocation.

OAuth only

Do not paste a Seamward browser cookie or collector ingest token into an MCP client. The client discovers OAuth metadata and requests a dedicated read grant.

OAuth 2.1

Connect remote clients without copying browser sessions or ingest tokens.

The MCP endpoint publishes protected-resource metadata. The authorization server publishes RFC 8414 metadata, supports dynamic public-client registration, requires authorization code with PKCE, and issues 15-minute signed access tokens bound to the exact MCP audience.

Workspace grants

Bind each grant to one user, client, and workspace.

One grant belongs to one user, one OAuth client, and one selected workspace. Seamward revalidates token signature, issuer, audience, current membership, and active consent on every request. Revoking the client in Workspace settings → MCP immediately rejects an already-issued token.

Scopes

Request only the read access required by the client.

seamward:workspace:read for overview and integration health
seamward:incidents:read for incidents, findings, and redacted evidence
seamward:repairs:read for replay validation and proposals
seamward:repairs:export for an already-approved repair bundle