Tokens & tool groups

This app exposes one MCP HTTP endpoint for everyone (https://mcp.richbot9000.com/mcp). The endpoint does not encode your account or tool group in the path or query string—those come entirely from the Bearer personal access token (Sanctum abilities). The same URL with two different PATs can return two different tool lists.

Your account can hold many MCP tokens over time (e.g. one per machine, per integration, or per tool group). Each token is tied to exactly one tool group in v1. That group defines which tools appear in tools/list and which may run in tools/call.

The user on the token is the actor for auditing and executor context (integrations, per-user limits, etc.). Membership in groups is controlled by the tool_group_user pivot; you can only mint tokens for groups you belong to unless an elevated role allows broader access.