DocsLog in

The AI trust layer between agents: identity, agreements, safeguards, and outcome intelligence for A2A.

Commit 39e235ac

39e235ac59f4Merged

aryaamin <[email protected]> · 2 months ago · 18 files · +2 added · ~16 modified

Browse files at this commit

Description

feat: add agent-scoped MCP access tokens

Details

Commit
39e235ac59f4
Parent
32cfcb5542e9

README.mdmodifiedView file

@@ -32,12 +32,18 @@
3232 - MCP stdio server: `corepack pnpm mcp`
3333 - Remote MCP after deployment: `https://<deployment>/mcp`
3434
35-The remote MCP endpoint uses Auth0 OAuth. Install Auth0 through the Vercel Marketplace, configure
35+Interactive MCP clients use Auth0 OAuth. Install Auth0 through the Vercel Marketplace, configure
3636 `AUTH0_DOMAIN`, `AUTH0_CLIENT_ID`, `AUTH0_AUDIENCE`, and `OPENCLASP_MCP_URL`, then enable Auth0's
3737 Resource Parameter Compatibility Profile and Dynamic Client Registration. Compatible MCP clients
3838 discover Auth0 through `/.well-known/oauth-protected-resource`, open hosted login and consent, and
3939 retry with an audience-bound bearer token. The local stdio server remains available for development.
4040
41+Hosted providers that cannot run OAuth, including Botpress-style static MCP clients, use a
42+revocable agent access token. Generate one under **Agents → Hosted-provider MCP access**, choose
43+Bearer authentication in the provider, and paste the token once. The credential is scoped to that
44+agent and `mcp:access`, stored only as a SHA-256 hash, expires within one year, and can be revoked
45+immediately. Never reuse a dashboard or interactive OAuth token for a hosted provider.
46+
4147 On first use, tell the connected agent to set itself up. It calls `openclasp_setup` with its project,
4248 identity and capabilities. Approve the proposal once on the dashboard, then connect the agent's
4349 mode. A temporary chat is immediately assigned a hosted A2A endpoint. A persistent agent must also
@@ -71,9 +77,9 @@
7177 OpenClasp's web login presents only Google and GitHub. Complete the one-time provider setup in
7278 [`docs/SOCIAL_LOGIN_SETUP.md`](docs/SOCIAL_LOGIN_SETUP.md) before using it outside of testing.
7379
74-The MCP server currently requires Auth0's `mcp:access` permission. Before a public beta, add and enforce
75-separate `profile:read`, `interaction:write`, `feedback:write`, `agent:manage`, and
76-`network:contribute` permissions in Auth0.
80+Agent access tokens currently carry only `mcp:access`. Before a public beta, add and enforce separate
81+`profile:read`, `interaction:write`, `feedback:write`, `agent:manage`, and `network:contribute`
82+permissions across both OAuth and agent-token authentication.
7783
7884 ## What the demo proves
7985