Gessa Docs
Generated Reference

Reference

Security

Gessa MCP supports OAuth 2.1 with PKCE S256, Resource Indicators, Protected Resource Metadata, Authorization Server Metadata, short-lived access tokens, refresh-token rotation, and scoped MCP API keys for stdio clients.
engine v1.0.234Copy for LLM

Scopes:

  • mcp:read: read-only tools.
  • mcp:write: mutating creator tools.
  • mcp:admin: destructive and live-ops tools.
  • mcp:platform: platform staff operations.

MCP client bearer tokens are never forwarded to downstream APIs. The resource server validates the credential and derives an internal principal for canonical service calls.

Was this helpful?Report an issueContact support