MCP server

POST /mcp implements JSON-RPC 2.0 (initialize, tools/list, tools/call, resources/list, resources/read, prompts/list, prompts/get). Authenticate with an API key or OAuth token with the mcp:use scope.

Tools are high-level business actions: authpermit_identity_verify, authpermit_credential_verify, authpermit_credential_issue, authpermit_trust_assessment, authpermit_case_create, authpermit_automation_simulate … Read tools are safe; action tools need matching permissions; high-risk tools return a pending approval task instead of executing. Resources: authpermit://identity/<id>, authpermit://credential/<id>, authpermit://verification/<id>.

There is no MCP backdoor: every tool executes the same command an API call would. Every tool is a capability in GET /api/v1/capabilities with the same permission as its REST route; tools such as authpermit_endpoint_quarantine and authpermit_incident_declare are generated from the capability, input schema included.

AI autonomy ceiling

Your organization sets the most dangerous kind of tool an AI agent may run without a person approving it: none, read, analyze, mutate or destructive (the default, which leaves the mcp.tool policy in charge). Anything above the ceiling becomes a pending approval task. critical capabilities are above every ceiling. The ceiling and the tool's danger class are also facts in the mcp.tool policy, so a policy can be stricter still.