MCP (pilot)
Implementation status
Track the verified pilot and the remaining production gates.
Pilot verified, production gates remain
The protocol, OAuth, tenant isolation, tool call, connected-client UI, and immediate revocation path pass local end-to-end verification. This is not a general-availability claim.
Available in pilot
Review the protocol, authorization, and read surfaces already built.
- Stateless Streamable HTTP at
POST /mcp - OAuth discovery, PKCE consent, workspace grants, and connected-client revocation
- 8 read-only tools, 6 resource patterns, and 2 prompts
- Tenant-isolation, scope, audience, membership, and revocation checks
- Approved repair manifest, readable report, and TypeScript patch resources
Not generally available
Review the production and support boundaries still outstanding.
- A hosted production MCP URL
- A published compatibility matrix for desktop, CLI, and IDE clients
- General-availability support or uptime commitments
- Write tools for approval, GitHub delivery, merge, or deployment
Release gates
Review the operational checks required before general availability.
- Terminate TLS on the public MCP and OAuth URLs without a development relay
- Add production rate limits, request timeouts, concurrency bounds, and protocol telemetry
- Run secret scanning and foreign-identifier tests in CI
- Complete MCP Inspector plus supported desktop and CLI clean-room tests
- Run production migration, rollback, and smoke-test procedures