Authentication and security

Human authentication

Hosted MCP users authenticate through Clerk OAuth. The active Clerk organization ID becomes the tenant boundary. Removed memberships fail closed, and sessions without an active organization cannot access tenant data.

The pilot presents one practical user experience inside each organization, while the protocol retains admin, operator, and viewer permissions for future policy refinement.

Agent authentication

Runtime credentials are high-entropy bearer secrets scoped to one organization, project, environment, and service. PostgreSQL stores only their SHA-256 hashes. Plaintext is returned once when created and cannot be listed later.

Network boundary

Public traffic terminates TLS at the Google Cloud HTTPS load balancer. The VM origin accepts broker traffic only from Google load balancer and health-check ranges. Runtime agents need only outbound HTTPS access; no inbound connection to the client application is required.

Break-glass access

A shared internal admin key remains available for local stdio and operator recovery. It is stored in Google Secret Manager and should not be distributed to ordinary users or embedded in application repositories.

Security limitations

• Bearer credentials must be protected wherever they are injected.
• Redaction rules cannot identify every domain-specific secret.
• Commit SHAs are honesty metadata, not bytecode attestation.
• Database append-only audit controls are not cryptographic WORM.
• JDWP must never be exposed to the public network.