Connecting your first MCP server

Registering a server is the first of three independent gates. A call is dispatched only when all three pass, and each one denies on its own — so a connection that looks correct in the list can still refuse every call, for a reason the audit log will name.

• The connection exists and is active. A revoked or expired connection is refused before anything is dispatched.
• Its safety sweep has passed. An un-swept or failed-sweep connection is unreachable regardless of what any agent has been granted.
• The calling agent holds a grant on that connection naming the exact action. A grant for a different action on the same connection is not a match.

1. 1Register the server and store its credentialCredentials are encrypted at rest with the deployment's own key. A connection may instead hold a reference for a vault to resolve, though no vault product is selected for this platform yet.
2. 2Let the safety sweep runUntil the sweep passes, the connection is inert. This is deliberate: it means a newly added server cannot be called by an agent that already has a broad grant.
3. 3Grant one agent the actions it needsGrants are per agent, per connection, per action. Grant the narrowest set that does the job — a grant is the whole authorization, and widening one later is a reviewable change.

A grant is narrower than it first looks. It names one agent, one connection, and an explicit list of actions on that connection. It is not a role, not a capability tier, and it does not extend to a second connection of the same type.

Scoped to

One agentNot a role or a group

On

One connectionNot a connector type

Allowing

Named actionsNot a category of them

Grant the smallest set that does the job. Widening one later is a visible, reviewable change — which is the behaviour you want the first time somebody asks for a broader scope.

Every refusal is recorded with its reason, so a connector that appears configured but never works is diagnosable rather than mysterious. The three causes are distinct and are worth checking in order.

1. policy_alertNo policy rowNothing has been configured for this connection yet. Governance denies by default, so an unconfigured connection is unreachable rather than open.
2. pendingSweep not passedThe connection exists but its safety sweep has not passed. This is what stops a newly added server from being reachable by an agent that already holds a broad grant.
3. key_offNo matching grantThe connection is fine, but this agent has no grant naming this exact action. A grant for a sibling action on the same connection is not a match.

A connection's credential is encrypted at rest with the deployment's own key, and replacing it is a change to the connection rather than to any grant. Grants survive a rotation — they reference the connection, not the secret behind it.