Agents get a task.
Not your keys.

Auths MCP gives an agent the narrow authority required for one tool call. The server verifies the exact tool, canonical arguments, audience, and constraints before anything runs.

Explore the source How Auths works

Verified tool callExecutable

tool: database.query
resource: analytics/orders
arguments: digest:7c91…
constraints: read-only · 500 rows

Exact toolCanonical argumentsLocal enforcementDelegated authority

01The boundary

A model can propose.
Only proof permits.

Prompt content is not authority. A tool call crosses the execution boundary only when its proof resolves to the same canonical command the MCP server is about to run.

02From authority to execution

01 / Define

Profile the tool

The MCP profile defines canonical arguments and the executable command shape for each tool.

02 / Delegate

Grant the task

A human or workload delegates a bounded capability to the agent for a specific audience and time.

03 / Verify

Check at the server

The MCP server resolves the proof locally against the proposed tool call and trusted context.

04 / Execute

Run verified bytes

The adapter decodes the verified action and executes that command, not mutable caller input.

03What you can rely on

No bearer-token inheritance

Agents receive task authority without taking possession of a developer’s broadly privileged credential.

Argument binding

Tool name alone is insufficient. Security-relevant arguments are canonicalized and covered by the proof.

Server sovereignty

Each MCP server chooses its trusted roots and verification limits, then makes its own local decision.

Composable delegation

Authority can move through orchestrators and subagents while narrowing at every hop.

04At the enforcement point

Verify. Decode. Execute.

The verified action—not ambient credentials or unchecked request data—becomes the command.

mcp-server / tools.callpseudocode

// The proposed call is not executable yet.
result = auths.verify(
  request.proof,
  profile.canonicalize(request.call),
  server.trusted_context
)

command = profile.decode(result.verified_action)
execute(command)

Auths MCP

Let agents act without handing them the kingdom.

See how explicit trust, bounded delegation, and exact actions form one portable authorization model.

Follow the authority path

Agents get a task.Not your keys.

A model can propose.Only proof permits.