MODEL CONTEXT PROTOCOL
MCP: authorization and scopes
No Hostbip MCP endpoint, callable tool catalogue or verified client configuration is connected in this source release.
Authorize the account and the action.
This guide describes Hostbip’s intended trust boundary. The exact OAuth metadata and supported scopes still need the backend implementation.
Delegated access
The protected MCP service must validate the caller, token audience, expiry, scopes and resource ownership. Access to one Hostbip account must not imply access to another account or organization. Tokens issued for unrelated services must not be accepted or passed through as substitutes.
Customer authorization is not staff sign-in
The admin portal’s local MFA and Logto settings apply to staff administration. They do not automatically establish customer MCP authorization. Customer connections, revocation and consent must be implemented by the customer platform and MCP backend.
Revocation and least privilege
A customer needs a way to review and revoke connections. Backend permissions, budgets and allowed actions must be enforced on every call, not inferred from a tool description or an earlier connection.
Guides are editorial. Backend permissions and technical contracts remain authoritative.
Integration support ↗