Authentication
The BCTRL MCP server uses the same device-approval model as the CLI.
When a client connects, BCTRL asks you to approve the connection in a browser. After approval, the client receives an access token bound to the approved API key actor — MCP acts as that key.
Scopes
Scopes are tied to the API key, not to MCP. If the approved key cannot perform an action over the public API, the MCP server cannot either. To narrow what an agent can do, approve a key with narrower scopes.
OAuth metadata
Clients that support remote authorization discover the flow from:
The MCP endpoint itself is https://api.bctrl.ai/mcp.
API-key authentication
For CI or server-to-server use, some clients accept a bearer token directly instead of the browser flow. Pass a BCTRL API key as the bearer token; the server treats a non-OAuth token as an API key.
For non-interactive terminal automation, prefer the CLI with BCTRL_API_KEY. Use MCP when an AI client needs protocol-level tools, resources, and schemas.
Security
- Approve only clients you trust.
- Use the narrowest API-key scopes that fit the task.
- Rotate or revoke keys from the dashboard when access should end.
- Destructive operations require the same permissions as direct API calls.