Drive FounderReply from Claude, Cursor, or your own code.

It depends which surface you are on, and this is the thing to get right before you write anything. The MCP endpoint — POST /api/mcp — takes an fr_live_ bearer key, which you mint in the dashboard; that is what a key is for. The /api/v1 routes authenticate with your signed-in session instead, because they are the routes the app itself calls, and the 2 /api/v1/brain routes are the only ones that try a bearer key first and fall back to the session. Send a key to any of the other 78 v1 routes and you get a 401 — not because the key is invalid, but because those handlers never read the Authorization header. The public blog read API needs no credential at all; it only ever returns posts you have already marked published.

Not on a setting we chose for you. Writes arriving over the API land in the same approval queue the dashboard uses — send_reply and publish_content enqueue and do not dispatch. Two things change that, and both are yours: raising the autonomy dial for that action on that network, and, for press pitches only, the trust ladder — after fifteen consecutive approvals you made without editing the draft, send_press_pitch starts sending directly, while roughly one in twenty still routes through the queue as a spot-check, and any edit or rejection resets the streak and turns it back off. DMs and comments on third-party threads ship gated on every network and are never raised for you — not by a plan, an upgrade or a default. Raising one is a deliberate change you make yourself, the app names the platform rule you are crossing before it saves, and the decision is written to the audit log.

Any client that speaks JSON-RPC 2.0 over a single HTTP request and response, which covers Claude Desktop, Cursor, Windsurf and your own code. SSE and streamable-HTTP transport are not shipped, so a client that requires server push, notifications or sessions will not connect.

Your own. Every action goes out from an account you connected yourself, under a credential you can withdraw from that network’s own settings — and a key resolves to exactly one workspace, because the tools take no workspace id, so a key can only ever operate the workspace it belongs to.

The next request carrying it gets HTTP 401 from /api/mcp, the same as a request with no Authorization header at all. Revoking is immediate and there is nothing to clean up on your side.